Deployment Architecture

How to use multiple interfaces (NICs) for data replication on slave in an indexer cluster?

fatemabwudel
Path Finder

Hi,

A little background regarding my question: I have a cluster of three indexers with 4 NICs each. I have a working stable indexer cluster with just 1 interface doing everything by default (input from forwarders, data replication and comm. with master, and other house keeping stuff).
Since I had couple of unused NICs, I wanted to dedicate them solely for replication purposes, so I connected indexers to each other with dedicated cable on dedicated interfaces.

For ex: indxr1 is connected to indxr2 on eno2 and connected to indxr3 on eno3 with dedicated ethernet cables.
Similarly indrx2 is connected with other two indexers on dedicated interfaces (eno2, eno3).
Hence I ended up with having two IP addresses on which each indexer can listen for replicated data (one from each indexer) on dedicated cable.

Therefore my question is, how can I configure two IPs to accept replication data from other two indexers?
I know about the setting: register_replication_address = in server.conf, but I think it doesn't work for more than one IP (plz correct me if I am wrong).
Also, I believe I would need to specify the replication ports for those two listening interfaces as well, so how do I specify them as well?
Again, I am aware of the setting [replication_port://] stanza in server.conf, but will it allow me to specify multiple listening ports as well?

Lastly, is it even possible to do above (using two diff. interfaces for replication on same slave)?

Any help would be appreciated.

Thanks,
Fatema.

0 Karma
1 Solution

Masa
Splunk Employee
Splunk Employee

You are right. Unfortunately current Splunk does not have such configurations. How about binding the two interfaces to one?
Something like the following doc would help to try bonding NICs
http://www.cyberciti.biz/tips/linux-bond-or-team-multiple-network-interfaces-nic-into-single-interfa...

View solution in original post

0 Karma

Masa
Splunk Employee
Splunk Employee

You are right. Unfortunately current Splunk does not have such configurations. How about binding the two interfaces to one?
Something like the following doc would help to try bonding NICs
http://www.cyberciti.biz/tips/linux-bond-or-team-multiple-network-interfaces-nic-into-single-interfa...

0 Karma

fatemabwudel
Path Finder

Thanks Masa, for confirming on this. I will look into how to bond the two interfaces and use it, thanks for providing a reference link.

Fatema.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...