what happens when NAS used for search head pooling goes down?

[mfrost8]

Our search heads are on our indexers (i.e. they're the same thing). We're looking at doing search head pooling in that scenario.

When using NAS I tend to think not so much of "if" the storage will be unavailable but when. I realize that if it's disappears, searches (scheduled and manual) won't happen. What I'm most concerned about is if indexing of data would stop and Splunk would grind to a halt.

It would of course, be very cool if even searches would continue because Splunk switched to a "plan B" where it realized it couldn't write to the shared dir (NAS) but instead wrote to something locally until the NAS became available again.

What does Splunk do when the NAS used for search head pooling goes away and the search heads are also indexers?

Thanks

[rmorlen]

From what I understand you will lose your apps and not be able to access saved searches for users. We are also trying to find a solution for this problem.

[mfrost8]

I have since been told that you don't want to use search-head pooling on an indexer. Pooling would only apply to a standalone search head. Not that I'm thrilled with NFS in that situation either, but certainly keeping the NFS away from indexing is a good thing. At 2011 User Conf, I recall the presenter from Viacom talking about a solution where they would rsync certain data frequently between the search heads, simulating search head pooling but with better i/o rates in their case.