Getting Data In

Multi site Data center forwarding data to indexer?

aab5272
Engager

Considering multi site data center for log forwarding having same logs , lets say site 1 and site 2 logs are being forwarded to indexer ,will this two copy will counted twice while indexing license if yes then what should be the approach to filter one copy of data before forwarding ?

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Any forwarder sending data into any Indexer will only be counted once. If 2 servers are sending the same data (perhaps through an NFS cross mount), then you will get 2 copies of the data in splunk and each will count against the license. If you have a multi-site cluster where splunk deliberately makes multiple copies internally (1 forwarder sends 1 copy to 1 Indexer, then SPLUNK makes copies all around), then you will only ever see/search 1 copy and it will only count against the license once.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Any forwarder sending data into any Indexer will only be counted once. If 2 servers are sending the same data (perhaps through an NFS cross mount), then you will get 2 copies of the data in splunk and each will count against the license. If you have a multi-site cluster where splunk deliberately makes multiple copies internally (1 forwarder sends 1 copy to 1 Indexer, then SPLUNK makes copies all around), then you will only ever see/search 1 copy and it will only count against the license once.

0 Karma

koshyk
Super Champion

are you using Universal Forwarder to send these logs to Indexers? if yes, use autoLB and put names of all Indexers in the list to load balance, and the UF will work out where to send and it will send only one copy.

if you let me know which mechanism is used to send the data, we can answer. cheers

0 Karma

aab5272
Engager

Thanks for the response .
we are going to collect all the logs with syslog-ng and UF and sending it to intermediate forwarder which in turn would send data to indexer .

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...