Deployment Architecture
Highlighted

setting up data replication

Communicator

I am looking for tips, documentatio, etc in order to setup data replication between 2 production Splunk servers. So, when data gets indexed on server 1, then server 2 indexes the same data. However, if server 1 goes down and server 2 is active, server 2 indexes data, then when server 1 goes back online, data gets indexed.

Tags (2)
0 Karma
Highlighted

Re: setting up data replication

Ultra Champion

You can setup data replication using Splunk configuration(ie: your Indexers or Forwarders can clone events over to your replication Indexers) or at the infrastructure level(ie: SAN replication). Note , this answer is relevant to version 4.2/4.3 of Splunk.

Have a look at this link :
http://docs.splunk.com/Documentation/Splunk/4.3/Installation/Highavailabilityreferencearchitecture#D...replicationacrossindexerclusters

0 Karma
Highlighted

Re: setting up data replication

Path Finder

Ok. I read and now I know that I can do that, but where may I see some config configuration examples? I cannot find anything about that.

0 Karma
Highlighted

Re: setting up data replication

Splunk Employee
Splunk Employee

there are links from that topic to configuration details, for example: http://docs.splunk.com/Documentation/Splunk/4.3/Deploy/Setuploadbalancingd

0 Karma
Highlighted

Re: setting up data replication

Contributor

Look in to the current Splunk beta documentation. It will do what you are looking for in a clustered state.

0 Karma
Highlighted

Re: setting up data replication

Splunk Employee
Splunk Employee

As of Splunk 5.0, we've introduced Index Replication to handle data replication and recover gracefully from server failures. More info can be found here

http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/Aboutclusters

Highlighted

Re: setting up data replication

Path Finder

Does this work for 2 servers only? i.e. both servers acting as indexers and search heads?

0 Karma