Deployment Architecture

Splunk on Kubernetes - replication constraints

New Member


i am running Splunk on Kubernetes with SmartStore. In order to increase node CPU/memory utilization, I have collocated multiple indexers on the same nodes. (3 indexers per node with a total of 3 nodes). I am leveraging SmartStore.

I'd like to avoid a situation where one of the nodes crashes and all 3 replicas i had were there. I think there are 2 possible solutions for that:

  • SmartStore with write-through cache ?
  • Some kind of topology awareness - zones. Data are replicated across indexers belonging to different zones.

Are any of the above available in Splunk ?


0 Karma

Splunk Employee
Splunk Employee

Please see our Kubernetes Operator work, which uses piod anti-affinity to ensure you dont end up with indexers on the same nodes!!

0 Karma