Deployment Architecture

In Splunk, is there a way to have a cluster of forwarders (heavy or universal) ?

New Member


Is there a way to have a cluster of forwarders (heavy or universal) ?

We have multiple sources that send the same data to the indexer cluster, so we have X time the same data.
If we could have an active/passive cluster of forwarders, we could have only one time the data and the warranty that we always have the data on Splunk.


Tags (2)
0 Karma

Ultra Champion

@tdanielou, the best practice is to rely on the universal forwarder file systems as the caching backup whereas for heavy forwarders to use a set of them behind a load balancer, to ensure 100% availability.

0 Karma



for what reason do you have one source multiple times? If that is due to compliance, stageing or data governance requirements you might have to go the hard way and install redundant storage instances (indexes).

If your architectures guarantees that all sources are the same at all time ... you just need to ingest one.

If splunk is used to verify that all sources contain exactly the same data you are free to choose for your source files. Put each in a separate index peer or index, or all in one and a scheduled search on top of that.

Hope that helps!

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...