Deployment Architecture

setting up data replication


I am looking for tips, documentatio, etc in order to setup data replication between 2 production Splunk servers. So, when data gets indexed on server 1, then server 2 indexes the same data. However, if server 1 goes down and server 2 is active, server 2 indexes data, then when server 1 goes back online, data gets indexed.

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

As of Splunk 5.0, we've introduced Index Replication to handle data replication and recover gracefully from server failures. More info can be found here

Path Finder

Does this work for 2 servers only? i.e. both servers acting as indexers and search heads?

0 Karma


Look in to the current Splunk beta documentation. It will do what you are looking for in a clustered state.

0 Karma

Ultra Champion

You can setup data replication using Splunk configuration(ie: your Indexers or Forwarders can clone events over to your replication Indexers) or at the infrastructure level(ie: SAN replication). Note , this answer is relevant to version 4.2/4.3 of Splunk.

Have a look at this link :

0 Karma

Splunk Employee
Splunk Employee

there are links from that topic to configuration details, for example:

0 Karma

Path Finder

Ok. I read and now I know that I can do that, but where may I see some config configuration examples? I cannot find anything about that.

0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...