First, some background info on our Splunk system. We are setting up a 2-site cluster with a replication factor of 2. We have a search head cluster of about 3 to 4 nodes and our indexer cluster has about 11 indexers at each site. In addition, we have our networks separated out into private and public networks. Users log into Splunk through the public network, but all internal communications between the various nodes happen on the private network, which we have connected up to a dedicated private switch. We also have enough network interfaces on our nodes and our private switch to support either bonded interfaces or dual NIC connections with 2 separate IP addresses.
The question we have is, does Splunk support dual NIC connections with 2 separate IP addresses on a private network that is apart from the public network interface, which is on it's own public network? If the answer is no, then we have a follow-up question, which is will Splunk be able to utilize the bandwidth of a bonded network interface (1 x 10Gb VS. 2 x 10Gb connections) better than a single 10Gb connection? However, if the answer is yes, then that would allow us to get around the somewhat complicated configuration process for setting up bonded network interfaces through the OS by simply setting up 2 separate interfaces with 2 IP addresses, but we're not sure if Splunk can support this, what other's were thinking/trying/etc..
Here is a link to a similar question, but it's not exactly the question I have now (why do bonding VS. how to do bonding), so that is why I am asking a new question.
Thank you for your help and please let me know if you need more information!
https://answers.splunk.com/answers/72426/rhel-nic-bonding-with-splunk.html
... View more