Deployment Architecture

Splunk on Kubernetes - replication constraints

New Member


i am running Splunk on Kubernetes with SmartStore. In order to increase node CPU/memory utilization, I have collocated multiple indexers on the same nodes. (3 indexers per node with a total of 3 nodes). I am leveraging SmartStore.

I'd like to avoid a situation where one of the nodes crashes and all 3 replicas i had were there. I think there are 2 possible solutions for that:

  • SmartStore with write-through cache ?
  • Some kind of topology awareness - zones. Data are replicated across indexers belonging to different zones.

Are any of the above available in Splunk ?


0 Karma

Splunk Employee
Splunk Employee

Please see our Kubernetes Operator work, which uses piod anti-affinity to ensure you dont end up with indexers on the same nodes!!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!