Getting Data In

Is it possible to have fail-over rather than load balancing on to heavy forwarders?

luhadia_aditya
Path Finder

While architecting the splunk implementation we are caught up in to a scenario wherein we are trying to achieve fail-over, high availability configuration on to Heavy Forwarders. The requirement goes as -

We have 2 heavy forwarders (currently only one in use) on which data is written in to the log files using syslog-ng, further those log files are being monitored by Heavy Forwarders, note here that syslog-ng and heavy forwarder reside on the same instance. This particular instance actually listens on to a network port and then syslog-ng filters and writes that data to specific log files.

Now we would want to have the other heavy forwarder to act as a secondary instance, and if the primary (or first) heavy forwarder goes down then secondary heavy forwarder should start receiving data automatically.

We are not looking forward to have auto load balancing in which data would be forwarded to both the heavy forwarders simultaneously and if one goes down, other is still on duty. No. As stated we want fail over rather than auto LB.

Is this achievable ?
Any help, configurations, ideas, links, pointers are appreciable!
Thanks everyone.

0 Karma
1 Solution

MuS
Legend

Hi luhadia_aditya,

This is not related to Splunk. You need to setup this outside Splunk by using some other technique like F5 Network devices or DNS alias or Linux Heartbeat. Check Dr. Google there are tons of article related to syslog and fail-over / load-balancing setups.

cheers, MuS

View solution in original post

MuS
Legend

Hi luhadia_aditya,

This is not related to Splunk. You need to setup this outside Splunk by using some other technique like F5 Network devices or DNS alias or Linux Heartbeat. Check Dr. Google there are tons of article related to syslog and fail-over / load-balancing setups.

cheers, MuS

luhadia_aditya
Path Finder

Thanks MuS!! Appreciate your quick response.

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...