Splunk Search

Splunk HA architecture using SAN

KomalSharma
Explorer

Hello everyone,

I am referring to the HA option using SAN as explained in this document.

http://docs.splunk.com/Documentation/Splunk/latest/Installation/Highavailabilityreferencearchitectur...

I am wondering if anyone has implemented HA using SAN and if so, can you please share your experience?
Reading through older posts it looks like the data replication seems to be the preferred way.
Is there any distinct advantage of one method v/s another? We have just started using Splunk and want to do some analysis before commiting to our production setup.

Thanks,
Komal

Tags (1)

Damien_Dallimor
Ultra Champion

The SAN overview in that link describes an HA scenario by which you remount a single SAN volume onto a failover server instance when a primary server instance goes down.

There is also another SAN architecture that you can use to achieve an HA and DR position whereby you can enable SAN replication to your DR site. This is my preferred approach.

The alternative approach by using Splunk functionality is configuring your Splunk Forwarders to "auto load balance" and "data clone" over your primary and DR Indexer Clusters, which has additional license cost implications.

0 Karma
Get Updates on the Splunk Community!

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...