Forwarder with primary & fail-over indexer?

[dnolan]

Is there a way with the basic Forwarder to configure it to send events to server A if its up, and to server B only if server A becomes unavailable?

I've got four indexers, geographically distributed. I'd like to configure my forwarders to send to their closest indexer, with fail-over to a second indexer if the primary is unavailalbe.

I could do AutoLB with a REALLY HIGH frequency, but thats a hack, and doesn't properly handle the situation where the primary indexer comes back up. I want the forwarders to switch back to the primary automatically.

[dnolan]

Because my license isn't infinite... 🙂

[Stephen_Sorkin · Accepted solution]

There is no way to do this in Splunk. Forwarding destinations are always considered symmetrically (in the case of load balancing) or independently (in the case of cloned groups). You may be able to use an off the shelf load balancer or cluster manager to route TCP connections appropriately.

[Simeon]

I would not recommend doing this due to the change in distribution of data. The only usable scenario for this I could imagine, would be for network traffic that is sent through an intermediate forwarder. In that case, it makes more sense to use syslog-ng and write the events to a file that is then monitored by the Splunk Forwarder. A big consideration with the functionality you describe, is that you will have data in two different places.

If your desire is to have some temporary back up, I recommend you perform data cloning as that will allow you to search the data before your primary indexer went down.

[gkanapathy]

Why would you do this rather than have the forwarder distributing to both indexers at all times? When one fails, then all traffic will go to the remaining one.