Splunk Search

Has anyone successfully front ended deployment servers, receivers, or search heads with a load balancer?

Builder

any gotchas, tips, tricks or advice with start of such projects?

0 Karma
1 Solution

Splunk Employee
Splunk Employee

It depends :

  • receivers, you probably means Indexers.
    You can use the splunk loadbalancing built in the forwarders, they will alternate between all the indexers they know.
    OR you can use a single dns record for all your indexers, and use a dns load balancer to point alternatively to a different indexer IPs.
    see http://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Setuploadbalancingd

  • search-head load balancing is the most delicate.
    It will require search-head pooling (you need the users profiles and search artifacts to be shared between all the search-heads)
    see http://docs.splunk.com/Documentation/Splunk/6.0/DistSearch/Usealoadbalancerwiththesearchheadpool

  • deployment servers can be behind a dns load balancer.
    That way the clients will connect to one or another, but you will have to synchronize perfectly all your deployments server assets to avoid redeploying slightly different versions of the apps in loop. There are no documentation on those exotic setup. You may want to use a version control system to maintain your serverclass.conf and deployment-apps.
    (FYI the cascading is not mentioned in Splunk 6.* anymore because of the rewriting of the deployment server code)

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

It depends :

  • receivers, you probably means Indexers.
    You can use the splunk loadbalancing built in the forwarders, they will alternate between all the indexers they know.
    OR you can use a single dns record for all your indexers, and use a dns load balancer to point alternatively to a different indexer IPs.
    see http://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Setuploadbalancingd

  • search-head load balancing is the most delicate.
    It will require search-head pooling (you need the users profiles and search artifacts to be shared between all the search-heads)
    see http://docs.splunk.com/Documentation/Splunk/6.0/DistSearch/Usealoadbalancerwiththesearchheadpool

  • deployment servers can be behind a dns load balancer.
    That way the clients will connect to one or another, but you will have to synchronize perfectly all your deployments server assets to avoid redeploying slightly different versions of the apps in loop. There are no documentation on those exotic setup. You may want to use a version control system to maintain your serverclass.conf and deployment-apps.
    (FYI the cascading is not mentioned in Splunk 6.* anymore because of the rewriting of the deployment server code)

View solution in original post

0 Karma

Builder

Thanks for the tip on DNS Round robin for deployment servers. That might be just the right level of effort for that role type. Next challenge is to figure out how to maintain SSL based communications through a layer 7 load balancer for the search heads.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!