Splunk Enterprise

Archiving data with multiple indexers in a clustered environment

GaetanVP
Contributor

Hello Splunkers,

In a Splunk clustered environment, the "coldToFrozenDir" will be the same for each indexer since it's deployed by the master node for each indexers.

So how Splunk will handle the fact that each indexers has replicated  data ? Will the data be duplicated on my archive storage ?

Regards,
GaetanVP  

Labels (1)
Tags (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

If those directories are different then you have RF count of versions. One primary and other secondaries.

If you want only one then you must use coldToFrozenScript (check the correct name). In this script you can define what you are archiving and how many copies. Probably good way is archive primary and also one secondary copy?

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...