Splunk Enterprise

DB input in indexer cluster (&speed of data replication)

Contributor

Hey guys,

I'm configuering indexer cluster, so I'm gonna have like this:

sh1+sh2

ix1+ix2+ix3_master (indexer cluster)

1. How should I configure DB input from our Oracle DB to the indexer cluster?

2. And what speed of data replication will I have? Just in general.

Some specifics:

CentOS Linux, about 8 CPU and 16 Gb of RAM each ix node.

 

Labels (1)
1 Solution

SplunkTrust
SplunkTrust

Don't install DB Connect on an indexer cluster.  Use a Heavy Forwarder for your DBX inputs.  Put DBX on your search heads for dbxquery commands.

Data replication speeds vary depending on network speed and latency as well as how busy the indexers and cluster master are.

Your hardware is below Splunk's recommended minima.  That may be fine or may perform poorly depending on your data ingestion rate and how many searches run at a time.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SplunkTrust
SplunkTrust

Don't install DB Connect on an indexer cluster.  Use a Heavy Forwarder for your DBX inputs.  Put DBX on your search heads for dbxquery commands.

Data replication speeds vary depending on network speed and latency as well as how busy the indexers and cluster master are.

Your hardware is below Splunk's recommended minima.  That may be fine or may perform poorly depending on your data ingestion rate and how many searches run at a time.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Contributor

Thanks a lot, Rich! But what with disaster recovery? I mean should that heavy forwarder be a "backuped" server? Or maybe a containerized thing?.. I this case a lot depends whether my Heavy FWR is alive...

And regarding speed, if I manage to min recommended set up, is 5-15 seconds speed of replication accesseble?

0 Karma

SplunkTrust
SplunkTrust
For redundancy. use a cold standby HF. Running DB Connect on two HFs simultaneously risks data duplication (likewise for running DBX on an indexer cluster).
---
If this reply helps you, an upvote would be appreciated.
0 Karma