Deployment Architecture

In Splunk, is there a way to have a cluster of forwarders (heavy or universal) ?

New Member


Is there a way to have a cluster of forwarders (heavy or universal) ?

We have multiple sources that send the same data to the indexer cluster, so we have X time the same data.
If we could have an active/passive cluster of forwarders, we could have only one time the data and the warranty that we always have the data on Splunk.


Tags (2)
0 Karma

Ultra Champion

@tdanielou, the best practice is to rely on the universal forwarder file systems as the caching backup whereas for heavy forwarders to use a set of them behind a load balancer, to ensure 100% availability.

0 Karma



for what reason do you have one source multiple times? If that is due to compliance, stageing or data governance requirements you might have to go the hard way and install redundant storage instances (indexes).

If your architectures guarantees that all sources are the same at all time ... you just need to ingest one.

If splunk is used to verify that all sources contain exactly the same data you are free to choose for your source files. Put each in a separate index peer or index, or all in one and a scheduled search on top of that.

Hope that helps!

0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...