Splunk Search

Small Setup DR

mbalzarini
New Member

We have a very small install of a single Splunk 6.01 server. We are required to have DR capability for all of our production servers and I wanted to see what the best way to do this. Would the reccomended route be to setup a Forwarder from our Prod server to the DR server and run with the "indexAndForward = true" setting? Thank you for your assistance.

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

There are several approaches, depending on what you need in which disaster scenario.

Your idea should work for mirroring data that arrives at your prod server while it is available, but what happens once the prod server dies? It loses its data, no problem - that was mirrored to the DR server... but now the DR server stops getting data because the prod server is gone. Whether that's a problem for you or not depends on your risk management requirements.

As an alternative, you can configure your forwarders to clone the data to prod and DR, so even when the prod server dies the DR server is still getting data.

As another alternative, you can set up a small Splunk cluster. That won't impact your license, but only protect against small-scale failures of single machines - not against a major datacenter disaster.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

There are several approaches, depending on what you need in which disaster scenario.

Your idea should work for mirroring data that arrives at your prod server while it is available, but what happens once the prod server dies? It loses its data, no problem - that was mirrored to the DR server... but now the DR server stops getting data because the prod server is gone. Whether that's a problem for you or not depends on your risk management requirements.

As an alternative, you can configure your forwarders to clone the data to prod and DR, so even when the prod server dies the DR server is still getting data.

As another alternative, you can set up a small Splunk cluster. That won't impact your license, but only protect against small-scale failures of single machines - not against a major datacenter disaster.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...