Splunk Search

Splunk Forwarder preferred path

djluke
Path Finder

Hi Splunkers,
does anyone have an idea how to configure a preferred path on a Splunk Forwarder?
I have 2 datacenters with many UF sending data in balanced mode to local indexers.
I would like to configure UF to automatically send data to indexers in the other DC only in case local ones are unavailable (maintenance / crash / ...)

Capture.PNG

 

Thanks in advance
Any suggestion will be very appreciated

Labels (1)
0 Karma
1 Solution

PickleRick
Ultra Champion

UF's loadbalanced group is served as a whole. So you could try to set the load-balancing limits to make the UF never switch to another output but you never know which one will be tried first. Also after switching to the other one in case of emergency, the UF would never fall back to the "primary site".

With a sufficiently recent forwarder you could use httpout and external LB (like haproxy) with properly configured backend policy.

View solution in original post

0 Karma

PickleRick
Ultra Champion

UF's loadbalanced group is served as a whole. So you could try to set the load-balancing limits to make the UF never switch to another output but you never know which one will be tried first. Also after switching to the other one in case of emergency, the UF would never fall back to the "primary site".

With a sufficiently recent forwarder you could use httpout and external LB (like haproxy) with properly configured backend policy.

0 Karma

djluke
Path Finder

Thanks for quick answer.
I was hoping we could handle it directly via Splunk configuration. Would it be the same even if I have a Heavy forwarder instead of UF?

0 Karma

PickleRick
Ultra Champion

I think so. While you could dynamically set TCP_ROUTE, I don't think you can get output channel state from within a transform.

0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...