Splunk high availability failover and loadbalancers

[aaronkorn]

Hello,

We are setting up our splunk environment up with a loadbalancer with a failover search head and have found this article that discusses rsync to keep our search heads up to date together http://wiki.splunk.com/Community:HighAvailabilityAndSplunk.

A couple questions come up with this though...

1) Are there any other files that should be rsynced other than whats mentioned?
2) For certain .conf files that have a hashed password how do we overcome syncing these files and allowing the secondary instance to decrypt the passwords?
3) Would you even recommend using loadbalancers in this fashion with rysnc? If not, any alternatives/recommendations?
4) Any considerations that I may be missing?

Right now we have about 30 users on one search head but would like our deployment to be scalable and resilient.

Thanks for the help!

[samhughe]

Can't help with the other bits as we're running search head pooling ourselves but the shared secret part of the following link might be useful for point 2: http://wiki.splunk.com/Community:How_to_add_a_search_head_to_your_pool