Splunk Enterprise Security

Disaster Recovery for ES SH cluster Enviornment

vinayakwagh
Loves-to-Learn Everything

what is the solution for DR where ES app is in Sh cluster?

0 Karma

DavidHourani
Super Champion

Hi @vinayakwagh,

I'm guessing you already know the difference between DR and HA for asking this question.

If you are looking for a DR solution for ES and you're already in stand-alone mode, then a backup of Splunk configuration including ES apps, ad-ons and the kv-store are enough. No need to setup a SH-Cluster, it will only complicate things.

If you're actually looking for HA, then SH clustering could be the solution for you, have a look here for the list of benefits of an SH-cluster:
https://docs.splunk.com/Documentation/Splunk/7.3.0/DistSearch/AboutSHC#Benefits_of_a_search_head_clu...

Cheers,
David

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!