Getting Data In

Is there index shardings in Splunk space?

danielwan
Explorer

Does Splunk 6.x support the index sharding across multiple indexers,e.g. I have an index called myindex, is it possible to spread it to multiple Splunk hosts to balance the workload w/o shared storage?

Tags (1)
0 Karma
1 Solution

inventsekar
Ultra Champion

Please check - indexer clusters and index replication
http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Aboutclusters

Indexer clusters are groups of Splunk Enterprise indexers configured to replicate each others' data, so that the system keeps multiple copies of all data. This process is known as index replication. By maintaining multiple, identical copies of Splunk Enterprise data, clusters prevent data loss while promoting data availability for searching.

Indexer clusters feature automatic failover from one indexer to the next. This means that, if one or more indexers fail, incoming data continues to get indexed and indexed data continues to be searchable.

Update - if you are not looking for indexer clustering, then, you can work out like this -
- configure splunk indexers manually creating the required indexes
- configure the forwarders to send data to required index's on particular indexers.
the configuration requires little bit more planning, but this is achievable.

View solution in original post

0 Karma

danielwan
Explorer

Indexer cluster and index replication do not suites my demand, I am seeking an approach to place the pieces(shards) of the same index on different hosts, which means each host only store part of myindex, meanwhile, myindex is still logically one single index.

0 Karma

inventsekar
Ultra Champion

Yes, its possible..
you can manually configure indexes on splunk indexers.. on the forwarders, you can specify which indexer, which index the data should go.
http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Aboutindexesandindexers

danielwan
Explorer

Thanks.
How to accept your comment?

0 Karma

inventsekar
Ultra Champion

Hi @danielwan, thanks.. you can accept my first answer.. thanks again.

0 Karma

inventsekar
Ultra Champion

Please check - indexer clusters and index replication
http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Aboutclusters

Indexer clusters are groups of Splunk Enterprise indexers configured to replicate each others' data, so that the system keeps multiple copies of all data. This process is known as index replication. By maintaining multiple, identical copies of Splunk Enterprise data, clusters prevent data loss while promoting data availability for searching.

Indexer clusters feature automatic failover from one indexer to the next. This means that, if one or more indexers fail, incoming data continues to get indexed and indexed data continues to be searchable.

Update - if you are not looking for indexer clustering, then, you can work out like this -
- configure splunk indexers manually creating the required indexes
- configure the forwarders to send data to required index's on particular indexers.
the configuration requires little bit more planning, but this is achievable.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...