Install Splunk on Windows cluster?

[olsenf]

Can I install the Splunk service on a clustered service in Windows 2003 cluster? And if so, what is the best practice? I assume install it on a shared clustered drive, but also installed on both server instances? I'm hoping someone has done this before and has the correct "cookbook".

Thanks.

[ftk]

I personally have not done it, but someone else may have done it. I am not quite sure what you are trying achieve with this, can you explain a bit? The reason I am asking is that there may be Splunk native tools to help you reach your goals. If your goal is more number crunching, it may be better to set up multiple Splunk indexers, and load balance all incoming data across your indexers. Then use a search head to search all these indexers. If your goal is HA, again multiple indexers may be a better way to go, and just clone the data in such a way that all indexers receive the same data.

Both these setups are easy to achieve using Splunk forwarders.

---

For more info on possible splunk architectures you can check the following links: http://www.splunk.com/base/Documentation/4.1.5/Installation/CapacityplanningforalargerSplunkdeployme...

http://www.splunk.com/base/Documentation/latest/Admin/Whatisdistributedsearch

http://www.splunk.com/base/Documentation/latest/Admin/Clonedata

http://www.splunk.com/base/Documentation/latest/Admin/Setuploadbalancing

http://www.splunk.com/base/Documentation/latest/Admin/Advancedindexingstrategy