There are several approaches, depending on what you need in which disaster scenario. Your idea should work for mirroring data that arrives at your prod server while it is available, but what happens once the prod server dies? It loses its data, no problem - that was mirrored to the DR server... but now the DR server stops getting data because the prod server is gone. Whether that's a problem for you or not depends on your risk management requirements. As an alternative, you can configure your forwarders to clone the data to prod and DR, so even when the prod server dies the DR server is still getting data. As another alternative, you can set up a small Splunk cluster. That won't impact your license, but only protect against small-scale failures of single machines - not against a major datacenter disaster. ... View more