Deployment Architecture

Data Archival-Clustered environment

garima_chauhan
Path Finder

Hi,
I have set up a clustered environment for testing purpose. The cluster comprises of 2 peers, a search head, a master node and a universal forwarder. All components are Splunk v5.0.5. I have set both the search factor and replication factor 2. I want to archive the data on each of the peers. When I push the common indexes.conf from the master node, I get indexing errors and the configuration does not work. If, I need to archive the data from both the peers, do I need to have a separate indexes.conf for each peer?

Thanks in anticipation.
Please respond.

Tags (2)
0 Karma

Steve_G_
Splunk Employee
Splunk Employee

All indexes need to be identical across all peers, if you want the data in the indexes to be replicated. See: http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configurethepeerindexes

Did you set repFactor=auto for any new indexes? If not, that might be the source of your configuration problems. This is explained in the topic referenced above.

0 Karma

garima_chauhan
Path Finder

Thanks Steve G. It turns out that the indexing errors that I was recieving were due to wrong configuration of archival policy.

0 Karma

austincisneros
New Member
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...