Deployment Architecture

Splunk high availability failover and loadbalancers

Splunk Employee
Splunk Employee


We are setting up our splunk environment up with a loadbalancer with a failover search head and have found this article that discusses rsync to keep our search heads up to date together

A couple questions come up with this though...

1) Are there any other files that should be rsynced other than whats mentioned?
2) For certain .conf files that have a hashed password how do we overcome syncing these files and allowing the secondary instance to decrypt the passwords?
3) Would you even recommend using loadbalancers in this fashion with rysnc? If not, any alternatives/recommendations?
4) Any considerations that I may be missing?

Right now we have about 30 users on one search head but would like our deployment to be scalable and resilient.

Thanks for the help!

0 Karma

Path Finder

Can't help with the other bits as we're running search head pooling ourselves but the shared secret part of the following link might be useful for point 2:

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>