Deployment Architecture

Looking for High Availability solution workaround for Heavy Forwarder

bishtk
Communicator

Hi Readers,

In my Splunk Cloud environment, we using HWF on Windows to fetch inputs via REST API (for example using Solarwinds Add-On for Splunk).

We not using any UF as its not required.

Wanted to know if there's any workaround/solution (be it splunk provided or third party) to implement HA for HWF

Thanks in advance

0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

Splunk currently doesn't have a HA solution for the HF/UF scenario where you need to maintain inputs in the case of an instance going down.

Other solutions out there do exist. We have customers that accomplish this via host clustering (using shared storage for either the Splunk mount or for the $splunk_home$/var/run folders where the fishbucket is housed. While I mainly see this in linux based environments with NFS, there is no reason it would work in windows assuming you have the clustering configuration up properly.

Other options would be via virtualization. Using Vmotion, or equivocal service, to migrate a VM to running hypervisor.

Those are the main options that I have seen previously with customers. Im sure there are other solutions, but these are probably the most simple in regards to technology required to deploy and maintain...

View solution in original post

esix_splunk
Splunk Employee
Splunk Employee

Splunk currently doesn't have a HA solution for the HF/UF scenario where you need to maintain inputs in the case of an instance going down.

Other solutions out there do exist. We have customers that accomplish this via host clustering (using shared storage for either the Splunk mount or for the $splunk_home$/var/run folders where the fishbucket is housed. While I mainly see this in linux based environments with NFS, there is no reason it would work in windows assuming you have the clustering configuration up properly.

Other options would be via virtualization. Using Vmotion, or equivocal service, to migrate a VM to running hypervisor.

Those are the main options that I have seen previously with customers. Im sure there are other solutions, but these are probably the most simple in regards to technology required to deploy and maintain...

Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...