Splunk Search

Has anyone successfully front ended deployment servers, receivers, or search heads with a load balancer?

dstaulcu
Builder

any gotchas, tips, tricks or advice with start of such projects?

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

It depends :

  • receivers, you probably means Indexers.
    You can use the splunk loadbalancing built in the forwarders, they will alternate between all the indexers they know.
    OR you can use a single dns record for all your indexers, and use a dns load balancer to point alternatively to a different indexer IPs.
    see http://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Setuploadbalancingd

  • search-head load balancing is the most delicate.
    It will require search-head pooling (you need the users profiles and search artifacts to be shared between all the search-heads)
    see http://docs.splunk.com/Documentation/Splunk/6.0/DistSearch/Usealoadbalancerwiththesearchheadpool

  • deployment servers can be behind a dns load balancer.
    That way the clients will connect to one or another, but you will have to synchronize perfectly all your deployments server assets to avoid redeploying slightly different versions of the apps in loop. There are no documentation on those exotic setup. You may want to use a version control system to maintain your serverclass.conf and deployment-apps.
    (FYI the cascading is not mentioned in Splunk 6.* anymore because of the rewriting of the deployment server code)

View solution in original post

0 Karma

yannK
Splunk Employee
Splunk Employee

It depends :

  • receivers, you probably means Indexers.
    You can use the splunk loadbalancing built in the forwarders, they will alternate between all the indexers they know.
    OR you can use a single dns record for all your indexers, and use a dns load balancer to point alternatively to a different indexer IPs.
    see http://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Setuploadbalancingd

  • search-head load balancing is the most delicate.
    It will require search-head pooling (you need the users profiles and search artifacts to be shared between all the search-heads)
    see http://docs.splunk.com/Documentation/Splunk/6.0/DistSearch/Usealoadbalancerwiththesearchheadpool

  • deployment servers can be behind a dns load balancer.
    That way the clients will connect to one or another, but you will have to synchronize perfectly all your deployments server assets to avoid redeploying slightly different versions of the apps in loop. There are no documentation on those exotic setup. You may want to use a version control system to maintain your serverclass.conf and deployment-apps.
    (FYI the cascading is not mentioned in Splunk 6.* anymore because of the rewriting of the deployment server code)

0 Karma

dstaulcu
Builder

Thanks for the tip on DNS Round robin for deployment servers. That might be just the right level of effort for that role type. Next challenge is to figure out how to maintain SSL based communications through a layer 7 load balancer for the search heads.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...