Splunk Dev

Move Index Files from one system to another

brianokelly
Explorer

We are planning to roll out an active/active solution in two data centers. Each DC splunk instance will only handle local logs. We are looking to put a plan in place should a failure of one site occur.

  1. What is the best mechanism/tools to handle this situation.
  2. What should be planned for e.g. use different index names in each site e.g. main_site1 and main_site2? Both sites will handle similar logs and peer to each other for searches.
Tags (2)
0 Karma

Lowell
Super Champion

I'd suggest that you also checkout this question and answer:

http://splunk-base.splunk.com/answers/7479/what-is-the-best-way-to-retrieve-data-from-a-remote-site-...

There's a comment about the isReadOnly setting in indexes.conf which you may want to look into as well. The idea is to prevent accidental writing to a replicated index. It's possible that read-only file permissions may also be a good idea in this case. (BTW, I assuming that you aren't going to try to let both sites index data into both each others directories, because that will not work.)

It may be a good idea to work though a plan with splunk support for your specific setup.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi brainokelly

about moving an index find the docs here.

If you plan to move one site to another in case of a failure, then I would do as you wrote in question 2. Call them main_site1 and main_site2. This way you are able to move the index back to its original site and even keep the data collected while it was on the failure site.

hope you can follow me 🙂

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...