Splunk Enterprise

DB input in indexer cluster (&speed of data replication)

highsplunker
Contributor

Hey guys,

I'm configuering indexer cluster, so I'm gonna have like this:

sh1+sh2

ix1+ix2+ix3_master (indexer cluster)

1. How should I configure DB input from our Oracle DB to the indexer cluster?

2. And what speed of data replication will I have? Just in general.

Some specifics:

CentOS Linux, about 8 CPU and 16 Gb of RAM each ix node.

 

Labels (1)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Don't install DB Connect on an indexer cluster.  Use a Heavy Forwarder for your DBX inputs.  Put DBX on your search heads for dbxquery commands.

Data replication speeds vary depending on network speed and latency as well as how busy the indexers and cluster master are.

Your hardware is below Splunk's recommended minima.  That may be fine or may perform poorly depending on your data ingestion rate and how many searches run at a time.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Don't install DB Connect on an indexer cluster.  Use a Heavy Forwarder for your DBX inputs.  Put DBX on your search heads for dbxquery commands.

Data replication speeds vary depending on network speed and latency as well as how busy the indexers and cluster master are.

Your hardware is below Splunk's recommended minima.  That may be fine or may perform poorly depending on your data ingestion rate and how many searches run at a time.

---
If this reply helps you, Karma would be appreciated.

highsplunker
Contributor

Thanks a lot, Rich! But what with disaster recovery? I mean should that heavy forwarder be a "backuped" server? Or maybe a containerized thing?.. I this case a lot depends whether my Heavy FWR is alive...

And regarding speed, if I manage to min recommended set up, is 5-15 seconds speed of replication accesseble?

0 Karma

richgalloway
SplunkTrust
SplunkTrust
For redundancy. use a cold standby HF. Running DB Connect on two HFs simultaneously risks data duplication (likewise for running DBX on an indexer cluster).
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...