Getting Data In

Splunk Forwarder HA load balancing

alexlee-mv
New Member

I know that we could configure Auto-load balancing on multiple indexer.
But I want to use an active standby approach to license count on duplicated data.

In this case, could I configure the forwarder to route all the event an indexer primarily and route to another indexer when primarily indexer is not available.

0 Karma

RubenOlsen
Path Finder

The forwarders behavior "out of the box" is to forward data to whatever indexers that are available.

In you scenario your secondary indexer could be turned off by default (i.e. not running) - and with some script check if your primary indexer is not running. If the primary indexer is not running - then start the secondary indexer.

Seen from the forwarder point of view - this is a "no-brainer" as it will buffer any inputs if your primary indexer dies until it can deliver to your secondary indexer (and vice versa).

The problem with this approach might be if you need to search the data from your primary indexer if this becomes unavailable.

I have not tried this my self - but this should work.

Another approach is to deploy a network load-balancer in front of both indexers, and let this device send data to either your primary or your secondary indexer.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...