Deployment Architecture

Data Replication/Cloning for HA architectures

Damien_Dallimor
Ultra Champion

Using Splunk functionality, I see that you can enable data cloning/replication either by:

a) configuring a forwarder to load balance over indexers in a primary cluster and also clone data to a indexers in a mirrored cluster

b) configuring the primary indexer cluster to replicate data to a mirrored indexer cluster

On the surface of things, I can't really see any glaringly major differences in either approach.

Any advice on the recommended approach would be appreciated.

DD.

mahamed_splunk
Splunk Employee
Splunk Employee

As of Splunk 5.0, the recommended approach is Index Replication.

More info

http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/Aboutclusters

0 Karma

Glenn
Builder

Benefits of B:

  • It ensures that datasets on primary and mirrored indexers are identical (if one indexer goes down in cloning situation, it may miss events while the other continues to accept them).
  • Moves extra resource usage (network traffic, cpu cycles) due to dealing with HA from the forwarder (where you probably don't want to interfere with your apps' performance) to the indexer.
  • You have the option to tweak what is and isn't forwarded between the primary and mirrored indexers if you want to for some reason. Option A is just a blind clone.
  • Probably some other reasons I don't know about! I know for a fact that HA using autoLB on forwarders and then forwarding data from the indexer(s) is now the official recommendation over the old recommendation of using cloning on the forwarders (according to our Splunk consultants and workshops at a SplunkLive event).
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...