Deployment Architecture

How to use multiple interfaces (NICs) for data replication on slave in an indexer cluster?

Path Finder

Hi,

A little background regarding my question: I have a cluster of three indexers with 4 NICs each. I have a working stable indexer cluster with just 1 interface doing everything by default (input from forwarders, data replication and comm. with master, and other house keeping stuff).
Since I had couple of unused NICs, I wanted to dedicate them solely for replication purposes, so I connected indexers to each other with dedicated cable on dedicated interfaces.

For ex: indxr1 is connected to indxr2 on eno2 and connected to indxr3 on eno3 with dedicated ethernet cables.
Similarly indrx2 is connected with other two indexers on dedicated interfaces (eno2, eno3).
Hence I ended up with having two IP addresses on which each indexer can listen for replicated data (one from each indexer) on dedicated cable.

Therefore my question is, how can I configure two IPs to accept replication data from other two indexers?
I know about the setting: registerreplicationaddress = in server.conf, but I think it doesn't work for more than one IP (plz correct me if I am wrong).
Also, I believe I would need to specify the replication ports for those two listening interfaces as well, so how do I specify them as well?
Again, I am aware of the setting [replication_port://] stanza in server.conf, but will it allow me to specify multiple listening ports as well?

Lastly, is it even possible to do above (using two diff. interfaces for replication on same slave)?

Any help would be appreciated.

Thanks,
Fatema.

0 Karma
1 Solution

Splunk Employee
Splunk Employee

You are right. Unfortunately current Splunk does not have such configurations. How about binding the two interfaces to one?
Something like the following doc would help to try bonding NICs
http://www.cyberciti.biz/tips/linux-bond-or-team-multiple-network-interfaces-nic-into-single-interfa...

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

You are right. Unfortunately current Splunk does not have such configurations. How about binding the two interfaces to one?
Something like the following doc would help to try bonding NICs
http://www.cyberciti.biz/tips/linux-bond-or-team-multiple-network-interfaces-nic-into-single-interfa...

View solution in original post

0 Karma

Path Finder

Thanks Masa, for confirming on this. I will look into how to bond the two interfaces and use it, thanks for providing a reference link.

Fatema.

0 Karma