Getting Data In

Multi site Data center forwarding data to indexer?

aab5272
Engager

Considering multi site data center for log forwarding having same logs , lets say site 1 and site 2 logs are being forwarded to indexer ,will this two copy will counted twice while indexing license if yes then what should be the approach to filter one copy of data before forwarding ?

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Any forwarder sending data into any Indexer will only be counted once. If 2 servers are sending the same data (perhaps through an NFS cross mount), then you will get 2 copies of the data in splunk and each will count against the license. If you have a multi-site cluster where splunk deliberately makes multiple copies internally (1 forwarder sends 1 copy to 1 Indexer, then SPLUNK makes copies all around), then you will only ever see/search 1 copy and it will only count against the license once.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Any forwarder sending data into any Indexer will only be counted once. If 2 servers are sending the same data (perhaps through an NFS cross mount), then you will get 2 copies of the data in splunk and each will count against the license. If you have a multi-site cluster where splunk deliberately makes multiple copies internally (1 forwarder sends 1 copy to 1 Indexer, then SPLUNK makes copies all around), then you will only ever see/search 1 copy and it will only count against the license once.

0 Karma

koshyk
Super Champion

are you using Universal Forwarder to send these logs to Indexers? if yes, use autoLB and put names of all Indexers in the list to load balance, and the UF will work out where to send and it will send only one copy.

if you let me know which mechanism is used to send the data, we can answer. cheers

0 Karma

aab5272
Engager

Thanks for the response .
we are going to collect all the logs with syslog-ng and UF and sending it to intermediate forwarder which in turn would send data to indexer .

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...