Deployment Architecture

Indexers cluster: Data synchronization after failure

noybin
Communicator

Hello,

I am creating an indexer cluster (2 peers and replication factor=2) and I need to know:

  1. If one of the peers is down, the other one keep receiving events (from the sources or HF) and responding searches to the Search Head right?

  2. When the peer is up again, does it receive the events generated during the time it was down? Or they will only reside in the peer that was up all the time?

  3. Do we need to backup both indexers although they have the same data?

Thank you very much.

0 Karma

noybin
Communicator

Thank you very much.

I've been reading what you sent me and I think that the answers are:

  1. YES
  2. YES
  3. ?

Is that correct?

Thank's again.

0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...