Looking for High Availability solution workaround for Heavy Forwarder

[bishtk]

Hi Readers,

In my Splunk Cloud environment, we using HWF on Windows to fetch inputs via REST API (for example using Solarwinds Add-On for Splunk).

We not using any UF as its not required.

Wanted to know if there's any workaround/solution (be it splunk provided or third party) to implement HA for HWF

Thanks in advance

[esix_splunk · Accepted solution]

Splunk currently doesn't have a HA solution for the HF/UF scenario where you need to maintain inputs in the case of an instance going down.

Other solutions out there do exist. We have customers that accomplish this via host clustering (using shared storage for either the Splunk mount or for the $splunk_home$/var/run folders where the fishbucket is housed. While I mainly see this in linux based environments with NFS, there is no reason it would work in windows assuming you have the clustering configuration up properly.

Other options would be via virtualization. Using Vmotion, or equivocal service, to migrate a VM to running hypervisor.

Those are the main options that I have seen previously with customers. Im sure there are other solutions, but these are probably the most simple in regards to technology required to deploy and maintain...