Deployment Architecture

Light forwarder behavior when one indexer is down (autolb disabled)

anantshah
Path Finder

Hello,

We are currently using light forwarders on our web boxes to forward iis logs to two indexers. One of the indexers went down and when it came back up, it did not receive data from during the outage. The 2nd indexer did not have any problems. Is this expected behavior? Does the forwarder buffer events for one indexer if the second one is up? Both indexers are independent.

Tags (1)
0 Karma
1 Solution

the_wolverine
Champion

In a cloning situation, if one indexer were to go down, Splunk will not buffer the events. As you have experienced, it will continue to send events to the other indexer.

http://www.splunk.com/wiki/Community:HighAvailabilityAndSplunk

There is the issue where the data on your indexers will be out-of-sync when such a situation arises.

View solution in original post

0 Karma

the_wolverine
Champion

In a cloning situation, if one indexer were to go down, Splunk will not buffer the events. As you have experienced, it will continue to send events to the other indexer.

http://www.splunk.com/wiki/Community:HighAvailabilityAndSplunk

There is the issue where the data on your indexers will be out-of-sync when such a situation arises.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...