Small Setup DR

[mbalzarini]

We have a very small install of a single Splunk 6.01 server. We are required to have DR capability for all of our production servers and I wanted to see what the best way to do this. Would the reccomended route be to setup a Forwarder from our Prod server to the DR server and run with the "indexAndForward = true" setting? Thank you for your assistance.

[martin_mueller · Accepted solution]

There are several approaches, depending on what you need in which disaster scenario.

Your idea should work for mirroring data that arrives at your prod server while it is available, but what happens once the prod server dies? It loses its data, no problem - that was mirrored to the DR server... but now the DR server stops getting data because the prod server is gone. Whether that's a problem for you or not depends on your risk management requirements.

As an alternative, you can configure your forwarders to clone the data to prod and DR, so even when the prod server dies the DR server is still getting data.

As another alternative, you can set up a small Splunk cluster. That won't impact your license, but only protect against small-scale failures of single machines - not against a major datacenter disaster.