Getting Data In

How to restore data in HA environment?

Alan_Bradley
Path Finder

When we build 2 Splunk indexing servers for High Availablity, 2 Splunk indexing servers may receive the same log data. While one of them is in maintenance phase, ONLY the other Splunk can get data. I'd like to restore missed data from another Splunk after the maintenace. Could you tell me what is the best way to do the above scenario?

0 Karma
1 Solution

jrodman
Splunk Employee
Splunk Employee

I don't think there is a good way to achieve this at the present time.

The best current response is to consider a pool of auto-lb systems to be one vesrion of the truth, so that if you have say four splunk instances, organized into two pools, then you can bring down one server from each pool at any given time and still have a complete duplicate set of data available in both pools when the nodes return.

View solution in original post

jrodman
Splunk Employee
Splunk Employee

I don't think there is a good way to achieve this at the present time.

The best current response is to consider a pool of auto-lb systems to be one vesrion of the truth, so that if you have say four splunk instances, organized into two pools, then you can bring down one server from each pool at any given time and still have a complete duplicate set of data available in both pools when the nodes return.

Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...