Deployment Architecture

How to use multiple interfaces (NICs) for data replication on slave in an indexer cluster?

fatemabwudel
Path Finder

Hi,

A little background regarding my question: I have a cluster of three indexers with 4 NICs each. I have a working stable indexer cluster with just 1 interface doing everything by default (input from forwarders, data replication and comm. with master, and other house keeping stuff).
Since I had couple of unused NICs, I wanted to dedicate them solely for replication purposes, so I connected indexers to each other with dedicated cable on dedicated interfaces.

For ex: indxr1 is connected to indxr2 on eno2 and connected to indxr3 on eno3 with dedicated ethernet cables.
Similarly indrx2 is connected with other two indexers on dedicated interfaces (eno2, eno3).
Hence I ended up with having two IP addresses on which each indexer can listen for replicated data (one from each indexer) on dedicated cable.

Therefore my question is, how can I configure two IPs to accept replication data from other two indexers?
I know about the setting: register_replication_address = in server.conf, but I think it doesn't work for more than one IP (plz correct me if I am wrong).
Also, I believe I would need to specify the replication ports for those two listening interfaces as well, so how do I specify them as well?
Again, I am aware of the setting [replication_port://] stanza in server.conf, but will it allow me to specify multiple listening ports as well?

Lastly, is it even possible to do above (using two diff. interfaces for replication on same slave)?

Any help would be appreciated.

Thanks,
Fatema.

0 Karma
1 Solution

Masa
Splunk Employee
Splunk Employee

You are right. Unfortunately current Splunk does not have such configurations. How about binding the two interfaces to one?
Something like the following doc would help to try bonding NICs
http://www.cyberciti.biz/tips/linux-bond-or-team-multiple-network-interfaces-nic-into-single-interfa...

View solution in original post

0 Karma

Masa
Splunk Employee
Splunk Employee

You are right. Unfortunately current Splunk does not have such configurations. How about binding the two interfaces to one?
Something like the following doc would help to try bonding NICs
http://www.cyberciti.biz/tips/linux-bond-or-team-multiple-network-interfaces-nic-into-single-interfa...

0 Karma

fatemabwudel
Path Finder

Thanks Masa, for confirming on this. I will look into how to bond the two interfaces and use it, thanks for providing a reference link.

Fatema.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...