Splunk Enterprise

Archiving data with multiple indexers in a clustered environment

GaetanVP
Contributor

Hello Splunkers,

In a Splunk clustered environment, the "coldToFrozenDir" will be the same for each indexer since it's deployed by the master node for each indexers.

So how Splunk will handle the fact that each indexers has replicated  data ? Will the data be duplicated on my archive storage ?

Regards,
GaetanVP  

Labels (1)
Tags (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

If those directories are different then you have RF count of versions. One primary and other secondaries.

If you want only one then you must use coldToFrozenScript (check the correct name). In this script you can define what you are archiving and how many copies. Probably good way is archive primary and also one secondary copy?

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...