Getting Data In

How to restore data in HA environment?

Alan_Bradley
Path Finder

When we build 2 Splunk indexing servers for High Availablity, 2 Splunk indexing servers may receive the same log data. While one of them is in maintenance phase, ONLY the other Splunk can get data. I'd like to restore missed data from another Splunk after the maintenace. Could you tell me what is the best way to do the above scenario?

0 Karma
1 Solution

jrodman
Splunk Employee
Splunk Employee

I don't think there is a good way to achieve this at the present time.

The best current response is to consider a pool of auto-lb systems to be one vesrion of the truth, so that if you have say four splunk instances, organized into two pools, then you can bring down one server from each pool at any given time and still have a complete duplicate set of data available in both pools when the nodes return.

View solution in original post

jrodman
Splunk Employee
Splunk Employee

I don't think there is a good way to achieve this at the present time.

The best current response is to consider a pool of auto-lb systems to be one vesrion of the truth, so that if you have say four splunk instances, organized into two pools, then you can bring down one server from each pool at any given time and still have a complete duplicate set of data available in both pools when the nodes return.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...