Getting Data In

Splunk Forwarder HA load balancing

alexlee-mv
New Member

I know that we could configure Auto-load balancing on multiple indexer.
But I want to use an active standby approach to license count on duplicated data.

In this case, could I configure the forwarder to route all the event an indexer primarily and route to another indexer when primarily indexer is not available.

0 Karma

RubenOlsen
Path Finder

The forwarders behavior "out of the box" is to forward data to whatever indexers that are available.

In you scenario your secondary indexer could be turned off by default (i.e. not running) - and with some script check if your primary indexer is not running. If the primary indexer is not running - then start the secondary indexer.

Seen from the forwarder point of view - this is a "no-brainer" as it will buffer any inputs if your primary indexer dies until it can deliver to your secondary indexer (and vice versa).

The problem with this approach might be if you need to search the data from your primary indexer if this becomes unavailable.

I have not tried this my self - but this should work.

Another approach is to deploy a network load-balancer in front of both indexers, and let this device send data to either your primary or your secondary indexer.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...