Splunk on Kubernetes - replication constraints

[sscharma]

Hi,

i am running Splunk on Kubernetes with SmartStore. In order to increase node CPU/memory utilization, I have collocated multiple indexers on the same nodes. (3 indexers per node with a total of 3 nodes). I am leveraging SmartStore.

I'd like to avoid a situation where one of the nodes crashes and all 3 replicas i had were there. I think there are 2 possible solutions for that:

• SmartStore with write-through cache ?
• Some kind of topology awareness - zones. Data are replicated across indexers belonging to different zones.

Are any of the above available in Splunk ?

BR
Simon

[mattymo]

Please see our Kubernetes Operator work, which uses piod anti-affinity to ensure you dont end up with indexers on the same nodes!!

https://github.com/splunk/splunk-operator/blob/master/docs/ChangeLog.md#006-alpha-2019-12-12