Getting Data In

Is it possible to have fail-over rather than load balancing on to heavy forwarders?

luhadia_aditya
Path Finder

While architecting the splunk implementation we are caught up in to a scenario wherein we are trying to achieve fail-over, high availability configuration on to Heavy Forwarders. The requirement goes as -

We have 2 heavy forwarders (currently only one in use) on which data is written in to the log files using syslog-ng, further those log files are being monitored by Heavy Forwarders, note here that syslog-ng and heavy forwarder reside on the same instance. This particular instance actually listens on to a network port and then syslog-ng filters and writes that data to specific log files.

Now we would want to have the other heavy forwarder to act as a secondary instance, and if the primary (or first) heavy forwarder goes down then secondary heavy forwarder should start receiving data automatically.

We are not looking forward to have auto load balancing in which data would be forwarded to both the heavy forwarders simultaneously and if one goes down, other is still on duty. No. As stated we want fail over rather than auto LB.

Is this achievable ?
Any help, configurations, ideas, links, pointers are appreciable!
Thanks everyone.

0 Karma
1 Solution

MuS
Legend

Hi luhadia_aditya,

This is not related to Splunk. You need to setup this outside Splunk by using some other technique like F5 Network devices or DNS alias or Linux Heartbeat. Check Dr. Google there are tons of article related to syslog and fail-over / load-balancing setups.

cheers, MuS

View solution in original post

MuS
Legend

Hi luhadia_aditya,

This is not related to Splunk. You need to setup this outside Splunk by using some other technique like F5 Network devices or DNS alias or Linux Heartbeat. Check Dr. Google there are tons of article related to syslog and fail-over / load-balancing setups.

cheers, MuS

luhadia_aditya
Path Finder

Thanks MuS!! Appreciate your quick response.

0 Karma
Get Updates on the Splunk Community!

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...