Splunk Enterprise

How to segregate Indexer peers in Indexing Cluster?

vprasadeee_7
Explorer

Dear Team,

 

Need your expert advice.

a. Indexer Cluster - Is it feasible to separate the replication of indexer peers among the peers themselves?

Illustration: Within the indexing cluster, the Master is associated with indexer peers A, B, C, and D. My aim is to ensure that the development data being forwarded to A is exclusively replicated with B. Likewise, the production logs should only be replicated among C and D. It's essential that the data between C and D, as well as A and B, remain non-replicated. Is this solution attainable?

Br,

Prasad V

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

If you need this kind of separation of logs inside indexer clusters you must create two separate clusters. One for test logs containing nodes A and B and second one for production contains nodes C + D.

In one cluster it replicates data among all nodes which clusters have. Basically you could remove node to be a target for replication, but that removes all replication. This is useful if/when you need to remove/replace some old nodes and it takes some time to run both old and new nodes at same time.

r. Ismo

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...