If i have 2 Datacenter sites, each with its own single indexer.
Can I setup up my forwarders in site1 to forward to indexer_site1 as default, but if indexer_site1 goes down can it then forward to indexer_site2. And vice versa for splunk forwarders in site2.
Hope that makes sense, in other works I always want my forwarders to log to their local indexer unless that local indexer in in contactable.
I presume this is a config in outputs.conf, any help would be appreciated.
thanks, conor
Hi conorglynn
other question: what will happen to the data from site1 on indexer_site2
if indexer_site1
is back online?
if you don't mind / care where the data is indexed, then setup load balancing all the time like in the docs written for setup load balancing
regards
thanks for leading me in the right direction MuS,
I think this is the best solution to have it permanently load balanced.
c