Splunk Enterprise

Restoring data to new indexer for DR

jeffbat
Path Finder

I am running Splunk Enterprise on prem and have a set of indexers in a cluster in one region and another set of indexers in a separate cluster in a different region.  

If region A is completely lost but we have backups in Region B of the data from Region A; is it possible to restore the data into the indexer cluster in Region B or would we have to restore the data and put into thawed and run the unthaw process bucket by bucket?

We are not running a multi-site cluster.

This is for a DR procedure but at the same time would be nice to know best way to do this as we have a 3rd cluster setup that eventually we will want the data in moved to one of the other clusters to allow for decommission of the 3rd clustered location.

(The same indexes exists in all 3 separated clustered environments.)

 

Thanks.

Labels (2)
Tags (2)
0 Karma
1 Solution

codebuilder
Influencer

Short answer is yes it's possible. But it is a complicated process. I would recommend you engage Splunk support to help you define a process specific to your environment.

----
An upvote would be appreciated and Accept Solution if it helps!

View solution in original post

0 Karma

codebuilder
Influencer

Short answer is yes it's possible. But it is a complicated process. I would recommend you engage Splunk support to help you define a process specific to your environment.

----
An upvote would be appreciated and Accept Solution if it helps!

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!