Splunk Enterprise

DB input in indexer cluster (&speed of data replication)

highsplunker
Contributor

Hey guys,

I'm configuering indexer cluster, so I'm gonna have like this:

sh1+sh2

ix1+ix2+ix3_master (indexer cluster)

1. How should I configure DB input from our Oracle DB to the indexer cluster?

2. And what speed of data replication will I have? Just in general.

Some specifics:

CentOS Linux, about 8 CPU and 16 Gb of RAM each ix node.

 

Labels (1)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Don't install DB Connect on an indexer cluster.  Use a Heavy Forwarder for your DBX inputs.  Put DBX on your search heads for dbxquery commands.

Data replication speeds vary depending on network speed and latency as well as how busy the indexers and cluster master are.

Your hardware is below Splunk's recommended minima.  That may be fine or may perform poorly depending on your data ingestion rate and how many searches run at a time.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Don't install DB Connect on an indexer cluster.  Use a Heavy Forwarder for your DBX inputs.  Put DBX on your search heads for dbxquery commands.

Data replication speeds vary depending on network speed and latency as well as how busy the indexers and cluster master are.

Your hardware is below Splunk's recommended minima.  That may be fine or may perform poorly depending on your data ingestion rate and how many searches run at a time.

---
If this reply helps you, Karma would be appreciated.

highsplunker
Contributor

Thanks a lot, Rich! But what with disaster recovery? I mean should that heavy forwarder be a "backuped" server? Or maybe a containerized thing?.. I this case a lot depends whether my Heavy FWR is alive...

And regarding speed, if I manage to min recommended set up, is 5-15 seconds speed of replication accesseble?

0 Karma

richgalloway
SplunkTrust
SplunkTrust
For redundancy. use a cold standby HF. Running DB Connect on two HFs simultaneously risks data duplication (likewise for running DBX on an indexer cluster).
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...