Getting Data In

Forwarder with primary & fail-over indexer?

Explorer

Is there a way with the basic Forwarder to configure it to send events to server A if its up, and to server B only if server A becomes unavailable?

I've got four indexers, geographically distributed. I'd like to configure my forwarders to send to their closest indexer, with fail-over to a second indexer if the primary is unavailalbe.

I could do AutoLB with a REALLY HIGH frequency, but thats a hack, and doesn't properly handle the situation where the primary indexer comes back up. I want the forwarders to switch back to the primary automatically.

Tags (1)
1 Solution

Splunk Employee
Splunk Employee

There is no way to do this in Splunk. Forwarding destinations are always considered symmetrically (in the case of load balancing) or independently (in the case of cloned groups). You may be able to use an off the shelf load balancer or cluster manager to route TCP connections appropriately.

View solution in original post

Explorer

Because my license isn't infinite... 🙂

0 Karma

Splunk Employee
Splunk Employee

There is no way to do this in Splunk. Forwarding destinations are always considered symmetrically (in the case of load balancing) or independently (in the case of cloned groups). You may be able to use an off the shelf load balancer or cluster manager to route TCP connections appropriately.

View solution in original post

Splunk Employee
Splunk Employee

I would not recommend doing this due to the change in distribution of data. The only usable scenario for this I could imagine, would be for network traffic that is sent through an intermediate forwarder. In that case, it makes more sense to use syslog-ng and write the events to a file that is then monitored by the Splunk Forwarder. A big consideration with the functionality you describe, is that you will have data in two different places.

If your desire is to have some temporary back up, I recommend you perform data cloning as that will allow you to search the data before your primary indexer went down.

0 Karma

Splunk Employee
Splunk Employee

Why would you do this rather than have the forwarder distributing to both indexers at all times? When one fails, then all traffic will go to the remaining one.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!