Splunk Search

Splunk Forwarder preferred path

djluke
Path Finder

Hi Splunkers,
does anyone have an idea how to configure a preferred path on a Splunk Forwarder?
I have 2 datacenters with many UF sending data in balanced mode to local indexers.
I would like to configure UF to automatically send data to indexers in the other DC only in case local ones are unavailable (maintenance / crash / ...)

Capture.PNG

 

Thanks in advance
Any suggestion will be very appreciated

0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

UF's loadbalanced group is served as a whole. So you could try to set the load-balancing limits to make the UF never switch to another output but you never know which one will be tried first. Also after switching to the other one in case of emergency, the UF would never fall back to the "primary site".

With a sufficiently recent forwarder you could use httpout and external LB (like haproxy) with properly configured backend policy.

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

UF's loadbalanced group is served as a whole. So you could try to set the load-balancing limits to make the UF never switch to another output but you never know which one will be tried first. Also after switching to the other one in case of emergency, the UF would never fall back to the "primary site".

With a sufficiently recent forwarder you could use httpout and external LB (like haproxy) with properly configured backend policy.

0 Karma

djluke
Path Finder

Thanks for quick answer.
I was hoping we could handle it directly via Splunk configuration. Would it be the same even if I have a Heavy forwarder instead of UF?

0 Karma

PickleRick
SplunkTrust
SplunkTrust

I think so. While you could dynamically set TCP_ROUTE, I don't think you can get output channel state from within a transform.

0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...