Knowledge Management

Forwarding data to dynamic IPs

av_
Path Finder

I am trying to forward data from UF to few indexers but the indexes have dynamic IPs which keep changing. Now, how does the UF know where to forward the data
How can I tackle this problem?

Also, can someone explain what is a smartstore & how does it work?

Labels (2)
0 Karma

hrawat_splunk
Splunk Employee
Splunk Employee

If there is a NLB in between UF/HF and indexing tier, you don't have to worry as DNS should return static IPs for NLB.
If there is no NLB in between UF/HF and indexing tier and you are banking on DNS to return dynamic IPs and your possible outputs.conf config is

 

server=<DNS alias for dynamic idx IPs>:<splunktcp port>

 

you must reduce dnsResolutionInterval in outputs.conf as low as possible. It will decide how fast new dynamic IPs picked by UF/HF.

0 Karma

deepakc
Builder

I've never come across an Splunk environment that uses dynamic IP's for indexers (might be asking for trouble) , but there may be some use cases, I don't know, probably cloud environments. Normally one would use static IP's and DNS service and name's for UF to Indexers communications. You would then configure your outputs.conf with those DNS names. The UF's have inbuilt functionality to spray portions of the data across the Indexers. So DNS may be the way forward for you. 

Example outputs.conf 

 

[tcpout]
defaultGroup = my_indexers

[tcpout:my_indexers]
server = indexer1.example.com:9997, indexer2.example.com:9997 

 

If using Indexer cluster, you can use the Cluster Master Discovery Option - Read all about it here. 

https://docs.splunk.com/Documentation/Splunk/9.2.1/Indexer/indexerdiscovery 

 

Regarding Smart Store - Read all about it here. 

https://docs.splunk.com/Documentation/Splunk/9.2.1/Indexer/AboutSmartStore 

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...