Splunk Enterprise

DB input in indexer cluster (&speed of data replication)

highsplunker
Contributor

Hey guys,

I'm configuering indexer cluster, so I'm gonna have like this:

sh1+sh2

ix1+ix2+ix3_master (indexer cluster)

1. How should I configure DB input from our Oracle DB to the indexer cluster?

2. And what speed of data replication will I have? Just in general.

Some specifics:

CentOS Linux, about 8 CPU and 16 Gb of RAM each ix node.

 

Labels (1)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Don't install DB Connect on an indexer cluster.  Use a Heavy Forwarder for your DBX inputs.  Put DBX on your search heads for dbxquery commands.

Data replication speeds vary depending on network speed and latency as well as how busy the indexers and cluster master are.

Your hardware is below Splunk's recommended minima.  That may be fine or may perform poorly depending on your data ingestion rate and how many searches run at a time.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Don't install DB Connect on an indexer cluster.  Use a Heavy Forwarder for your DBX inputs.  Put DBX on your search heads for dbxquery commands.

Data replication speeds vary depending on network speed and latency as well as how busy the indexers and cluster master are.

Your hardware is below Splunk's recommended minima.  That may be fine or may perform poorly depending on your data ingestion rate and how many searches run at a time.

---
If this reply helps you, Karma would be appreciated.

highsplunker
Contributor

Thanks a lot, Rich! But what with disaster recovery? I mean should that heavy forwarder be a "backuped" server? Or maybe a containerized thing?.. I this case a lot depends whether my Heavy FWR is alive...

And regarding speed, if I manage to min recommended set up, is 5-15 seconds speed of replication accesseble?

0 Karma

richgalloway
SplunkTrust
SplunkTrust
For redundancy. use a cold standby HF. Running DB Connect on two HFs simultaneously risks data duplication (likewise for running DBX on an indexer cluster).
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...