Deployment Architecture

Indexers cluster: Data synchronization after failure



I am creating an indexer cluster (2 peers and replication factor=2) and I need to know:

  1. If one of the peers is down, the other one keep receiving events (from the sources or HF) and responding searches to the Search Head right?

  2. When the peer is up again, does it receive the events generated during the time it was down? Or they will only reside in the peer that was up all the time?

  3. Do we need to backup both indexers although they have the same data?

Thank you very much.

0 Karma


Thank you very much.

I've been reading what you sent me and I think that the answers are:

  1. YES
  2. YES
  3. ?

Is that correct?

Thank's again.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...