Splunk Standalone Instance - Is clustering available for high availability>

[smcdonald20]

Hi,

We have a single standalone Splunk instance used for indexing, searching and alerts.
We want to have high availability in case one server goes down, but want to know if we can set up clustering so that Splunk manages the distribution of users/knowledge objects automatically.

I know that search head clustering and index clustering is possible, but not sure about a standalone instance as we can't see anything in the documentation...

Thanks,
Sophie

[woodcock]

What EXACTLY do you mean by Standalone Instance?

[woodcock]

@gcusello is describing Index(er) Clustering which protects the data. There is also Search Head Clustering to provide access to searchability.
Copied from the Distributed Search Manual:
http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/SHCsystemrequirements

Required number of instances
The cluster must contain at a minimum the number of members needed to fulfill both of these requirements:

• Three members, so that the cluster can continue to function if one member goes down. See "Captain election process has deployment implications."
• The replication factor number of instances. See "Choose the replication factor for the search head cluster."

For example, if your replication factor is either 2 or 3, you need at least three instances. If your replication factor is 5, you need at least five instances.

You can optionally add more members to boost search and user capacity (and complexity and fragility).

[smcdonald20]

Thanks @woodcock

Can you confirm if search head clustering will work with standalone instances?
So i assume the knowledge objects (searches, alerts, dashboards etc) will be clustered, but i'm wondering will the underlying data also be clustered with SH clustering?

OR are you saying that we'd move to distributed environment and do SH and IDX clustering for full HA?

[woodcock]

Neither of these options work with All-in-one architecture. For Indexers, you need multiple indexers and a Cluster Master. For Search Heads, you need multiple Search Heads.

[gcusello]

Hi @smcdonald20,
until the version 6.x it was possible to have two standalone clustered Splunk servers, from the version 7.x it isn't possible to do this because searches on clustered Indexers don't run.
You need at least:

• two Indexers;
• one Master Node (it isn't possible to use an Indexer for this role);
• at least one Search Head (it isn't possible to use the Master Node or one Indexer for this role).

In few words you need at least four servers.

In addition if you want HA also on Search Heads:

• if you want a real HA, you need at least three Search Heads and a Deployer (that could be shared with the Master Node),
• if you want a cold HA, you need at least two Searche Heads, and you have to manually manage the objects replication between Search Heads.

Ciao.
Giuseppe