Splunk Enterprise

DB input in indexer cluster (&speed of data replication)

highsplunker
Contributor

Hey guys,

I'm configuering indexer cluster, so I'm gonna have like this:

sh1+sh2

ix1+ix2+ix3_master (indexer cluster)

1. How should I configure DB input from our Oracle DB to the indexer cluster?

2. And what speed of data replication will I have? Just in general.

Some specifics:

CentOS Linux, about 8 CPU and 16 Gb of RAM each ix node.

 

Labels (1)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Don't install DB Connect on an indexer cluster.  Use a Heavy Forwarder for your DBX inputs.  Put DBX on your search heads for dbxquery commands.

Data replication speeds vary depending on network speed and latency as well as how busy the indexers and cluster master are.

Your hardware is below Splunk's recommended minima.  That may be fine or may perform poorly depending on your data ingestion rate and how many searches run at a time.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Don't install DB Connect on an indexer cluster.  Use a Heavy Forwarder for your DBX inputs.  Put DBX on your search heads for dbxquery commands.

Data replication speeds vary depending on network speed and latency as well as how busy the indexers and cluster master are.

Your hardware is below Splunk's recommended minima.  That may be fine or may perform poorly depending on your data ingestion rate and how many searches run at a time.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

highsplunker
Contributor

Thanks a lot, Rich! But what with disaster recovery? I mean should that heavy forwarder be a "backuped" server? Or maybe a containerized thing?.. I this case a lot depends whether my Heavy FWR is alive...

And regarding speed, if I manage to min recommended set up, is 5-15 seconds speed of replication accesseble?

0 Karma

richgalloway
SplunkTrust
SplunkTrust
For redundancy. use a cold standby HF. Running DB Connect on two HFs simultaneously risks data duplication (likewise for running DBX on an indexer cluster).
---
If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!