Getting Data In

Install Splunk on Windows cluster?

olsenf
New Member

Can I install the Splunk service on a clustered service in Windows 2003 cluster? And if so, what is the best practice? I assume install it on a shared clustered drive, but also installed on both server instances? I'm hoping someone has done this before and has the correct "cookbook".

Thanks.

Tags (2)
0 Karma

ftk
Motivator

I personally have not done it, but someone else may have done it. I am not quite sure what you are trying achieve with this, can you explain a bit? The reason I am asking is that there may be Splunk native tools to help you reach your goals. If your goal is more number crunching, it may be better to set up multiple Splunk indexers, and load balance all incoming data across your indexers. Then use a search head to search all these indexers. If your goal is HA, again multiple indexers may be a better way to go, and just clone the data in such a way that all indexers receive the same data.

Both these setups are easy to achieve using Splunk forwarders.


For more info on possible splunk architectures you can check the following links: http://www.splunk.com/base/Documentation/4.1.5/Installation/CapacityplanningforalargerSplunkdeployme...

http://www.splunk.com/base/Documentation/latest/Admin/Whatisdistributedsearch

http://www.splunk.com/base/Documentation/latest/Admin/Clonedata

http://www.splunk.com/base/Documentation/latest/Admin/Setuploadbalancing

http://www.splunk.com/base/Documentation/latest/Admin/Advancedindexingstrategy

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...