How to restore data in HA environment?

[Alan_Bradley]

When we build 2 Splunk indexing servers for High Availablity, 2 Splunk indexing servers may receive the same log data. While one of them is in maintenance phase, ONLY the other Splunk can get data. I'd like to restore missed data from another Splunk after the maintenace. Could you tell me what is the best way to do the above scenario?

[jrodman · Accepted solution]

I don't think there is a good way to achieve this at the present time.

The best current response is to consider a pool of auto-lb systems to be one vesrion of the truth, so that if you have say four splunk instances, organized into two pools, then you can bring down one server from each pool at any given time and still have a complete duplicate set of data available in both pools when the nodes return.