Splunk Search

Small Setup DR

mbalzarini
New Member

We have a very small install of a single Splunk 6.01 server. We are required to have DR capability for all of our production servers and I wanted to see what the best way to do this. Would the reccomended route be to setup a Forwarder from our Prod server to the DR server and run with the "indexAndForward = true" setting? Thank you for your assistance.

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

There are several approaches, depending on what you need in which disaster scenario.

Your idea should work for mirroring data that arrives at your prod server while it is available, but what happens once the prod server dies? It loses its data, no problem - that was mirrored to the DR server... but now the DR server stops getting data because the prod server is gone. Whether that's a problem for you or not depends on your risk management requirements.

As an alternative, you can configure your forwarders to clone the data to prod and DR, so even when the prod server dies the DR server is still getting data.

As another alternative, you can set up a small Splunk cluster. That won't impact your license, but only protect against small-scale failures of single machines - not against a major datacenter disaster.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

There are several approaches, depending on what you need in which disaster scenario.

Your idea should work for mirroring data that arrives at your prod server while it is available, but what happens once the prod server dies? It loses its data, no problem - that was mirrored to the DR server... but now the DR server stops getting data because the prod server is gone. Whether that's a problem for you or not depends on your risk management requirements.

As an alternative, you can configure your forwarders to clone the data to prod and DR, so even when the prod server dies the DR server is still getting data.

As another alternative, you can set up a small Splunk cluster. That won't impact your license, but only protect against small-scale failures of single machines - not against a major datacenter disaster.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>