Deployment Architecture

Indexers cluster: Data synchronization after failure

noybin
Communicator

Hello,

I am creating an indexer cluster (2 peers and replication factor=2) and I need to know:

  1. If one of the peers is down, the other one keep receiving events (from the sources or HF) and responding searches to the Search Head right?

  2. When the peer is up again, does it receive the events generated during the time it was down? Or they will only reside in the peer that was up all the time?

  3. Do we need to backup both indexers although they have the same data?

Thank you very much.

0 Karma

noybin
Communicator

Thank you very much.

I've been reading what you sent me and I think that the answers are:

  1. YES
  2. YES
  3. ?

Is that correct?

Thank's again.

0 Karma
Get Updates on the Splunk Community!

Splunk Certification Support Alert | Pearson VUE Outage

Splunk Certification holders and candidates!  Please be advised of an upcoming system maintenance period for ...

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...