Splunk enterprise and Enterprise Security High availability

[hariskhan]

Hi all,
I have a single splunk server machine running splunk enterprise 7. How can i create high availability solution for this.
Also how can i be able to ensure Splunk ES high availability if i have two Splunk enterprise server instances?.

[richgalloway]

A single-instance Splunk server cannot be HA. For Splunk to be highly available, you need multi-site search head and indexer clusters. Even that isn't perfect as the loss of a site may mean the search heads can't elect a new captain (among other possible problems).

Some have come up with other answers using various vmWare or cloud features.

I think HA is not supported for Enterprise Security.

[hariskhan]

So technically we cannot ensure high availability for Splunk enterprise or Enterprise security until we do clustering for Index and SH right?.

How about if we use shared storage that is available to primary Splunk instance and when that primary goes down we unmount the SAN storage from primary instance and then mount same storage to secondary instance?.

[richgalloway]

Even clustering won't be enough to make Enterprise Security HA. It is highly dependent on the KV Store, which be backed up regularly. Any secondary instance's recovery point will be determined by the most recent backup.

Shared storage can be made to work, but serves to reduce recovery time rather than be a true HA solution. Make sure the SAN's I/O rate is high enough to keep up with Splunk.

[hariskhan]

Thanks Sir,
Helped a lot.