Splunk Search

Splunk Forwarder preferred path

djluke
Path Finder

Hi Splunkers,
does anyone have an idea how to configure a preferred path on a Splunk Forwarder?
I have 2 datacenters with many UF sending data in balanced mode to local indexers.
I would like to configure UF to automatically send data to indexers in the other DC only in case local ones are unavailable (maintenance / crash / ...)

Capture.PNG

 

Thanks in advance
Any suggestion will be very appreciated

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

UF's loadbalanced group is served as a whole. So you could try to set the load-balancing limits to make the UF never switch to another output but you never know which one will be tried first. Also after switching to the other one in case of emergency, the UF would never fall back to the "primary site".

With a sufficiently recent forwarder you could use httpout and external LB (like haproxy) with properly configured backend policy.

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

UF's loadbalanced group is served as a whole. So you could try to set the load-balancing limits to make the UF never switch to another output but you never know which one will be tried first. Also after switching to the other one in case of emergency, the UF would never fall back to the "primary site".

With a sufficiently recent forwarder you could use httpout and external LB (like haproxy) with properly configured backend policy.

0 Karma

djluke
Path Finder

Thanks for quick answer.
I was hoping we could handle it directly via Splunk configuration. Would it be the same even if I have a Heavy forwarder instead of UF?

0 Karma

PickleRick
SplunkTrust
SplunkTrust

I think so. While you could dynamically set TCP_ROUTE, I don't think you can get output channel state from within a transform.

0 Karma
Get Updates on the Splunk Community!

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...