Deployment Architecture

Should the main index be replicated in an indexer cluster?

transtrophe
Communicator

I have a distributed splunk deployment with search-head cluster, indexer cluster and forwarders. Currently, the main index is not replicated across the index cluster peers. Is that recommended (or the inverse, NOT recommended)?

1 Solution

dwaddle
SplunkTrust
SplunkTrust

I would say "yes", if only for consistency's sake. Ideally little if any data winds up being stored in the main index - but if some does wind up there by accident (or misconfigured app), then it'd be really nice were it replicated.

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

I would say "yes", if only for consistency's sake. Ideally little if any data winds up being stored in the main index - but if some does wind up there by accident (or misconfigured app), then it'd be really nice were it replicated.

rsennett_splunk
Splunk Employee
Splunk Employee

Exactly... it's the only index that you could "accidentally" put something in... which implies it should be treated like an "intentional" and replicated index. 🙂

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...