Getting Data In

Data replication across indexers with license pools enabled

DFresh4130
Path Finder

We currently have one server running the indexer and search head. We're looking into adding a second indexer on a different host to take advantage of license pools. The new indexer would be set up to where only a subset of our clients would be pointing to it as we've had issues with another group consuming too much of our license. If we take that approach, will the data be replicated between both indexers to where we can take advantage of additional search resources or do indexers only keep they data being sent to them by the forwarders configured to use them?

0 Karma

Ayn
Legend

By default indexers do not automatically replicate data. You can enable this behaviour though by setting up index clusters. The docs have excellent explanations on how it works in detail, so I'll just refer to those: http://docs.splunk.com/Documentation/Splunk/6.1.2/Indexer/Aboutclusters

0 Karma

datasearchninja
Communicator

The indexer that receives the data from the forwarder will be the primary bucket for that data.

If you configure clustering/replication, the primary bucket will be copied to other indexers to meet whatever replication factor has been configured.

In a single site setup, any search will prefer to use the primary bucket for returning results if it is available.

0 Karma

DFresh4130
Path Finder

Ok, so I'm a little confused on the data the forwarders are sending. Do you have to load balance the forwarders between all indexers or can I point forwarders A,B,C to indexer 1 and forwarders D,E,F to indexer 2 and still have replication work correctly?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...