Deployment Architecture

What is a best practice for disaster recovery in case of a single Splunk Enterprise?

skender27
Contributor

Hi,

I am looking for a documentation which describes the necessary steps in case of a disaster recovery (the host where Splunk Enterprise is installed crashes at some point) when I have only one Splunk Enterprise and receiving from some forwarders.

Let's suppose all indexed data backups have been done regularly (under $SPLUNK_HOME/var/lib/splunk/<my_index>/db).
What is the ocfficial procedure of restoring Splunk? I found helpful this page: http://docs.splunk.com/Documentation/Splunk/6.5.0/Indexer/Backupindexeddata

Thanks a lot,
Skender

0 Karma
1 Solution

hunters_splunk
Splunk Employee
Splunk Employee

Hi Skender,

Here are some topics you can refer to on Splunk Docs:

Hope it helps. Thanks!
Hunter

View solution in original post

ddrillic
Ultra Champion

Skender, it really depends how far you are willing to invest in the architecture.

The following speaks to that - Scale your deployment with Splunk Enterprise components
The most challenging aspect of the installation is obviously the indexed part. The next page at Use clusters for high availability and ease of management
explains -

-- Splunk Enterprise clusters feature automatic failover from one indexer to the next. This means that, if one or more indexers fail, incoming data continues to get indexed and indexed data continues to be searchable.

0 Karma

skender27
Contributor

Hi,

At the moment the customer has ONLY one Splunk Enterprise (no clusters), so I think I should follow the steps and suggestions for backup and restoring all buckets.

Thanks a lot,
Skender

0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Hi Skender,

Here are some topics you can refer to on Splunk Docs:

Hope it helps. Thanks!
Hunter

skender27
Contributor

Thanks a lot!
I just knew well how to bring "online" the frozen buckets, but I was not so clear about hot and warm buckets.

Skender

0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

You are welcome, Skender! Glad to be of any help. 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...