Splunk Search

set up load balancing on indexer clustering

ehsan_it
New Member

Hi everyone.
I configured indexer clustering that include one master and 2 peers and the top of them we have a single search head
I created a index then deploy it to the indexers via master,also i added a udp input data on one of indexers
if main indexer comes down,we loss the data on index.
so we don't have any load balancing method can i configure LB for this environment without any forwarders?
please help me

BR,

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ehsan_it,
you should use a Load Balancer, if you have to distribute load between Indexers and manage fail over.
If you haven't a Load Banancer, you can configure your DNS to do this role: in other words, you should associate to one logical address (e.g. splunk_syslogs) the two IP addresses of Indexers, in this way, DNS can distribute load between both the Indexers in normal conditions and send them to the up Indexer when there are problems on the other.

On additional hint: if you can it should be better to separate syslogs receiving phase from indexing phase, pratically to use two Heavy Forwarders to receive syslogs insteda Indexers (always with a Load Balancer), and then they send logs to the Indexers that index them.
Why this: because Heavy Forwarders have less maintenance activities than Indexers so you lose less syslogs.

Ciao and Merry Christmas.
Giuseppe

0 Karma

martin_mueller
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...