Deployment Architecture

Process to copy index from one Windows Server to another

mship
Path Finder

I am running Splunk 5.0.1, am in a Windows workgroup enviornment, and have 2 Windows 2008R2 servers as indexers for redundancy (indexerA and B). What I am looking to do is to establish a process to, should one server go down, restore the index from the second server. Let's say indexer B goes down for a week and I am ready to bring it back up online this is the process that I would execute...

Indexer A - roll the hot dbs to warm by running the folling command:

  • $SPLUNK_HOME\Splunk _internal cal /data/indexes/main/roll-hot-buckets -auth admin:
  • disable splunkd on indexerA
  • log onto indexer B and map network drive to on indexer A
  • copy defaultdb from indexer A to indexer B
  • restart splunk on both instances and both indexes should now have the same exact data

Does this sound correct?

Tags (1)
0 Karma

mship
Path Finder

Ammend the above process to...

On indexer B create \defaultdb
log onto indexer A and map network drive to on indexer b
copy contents of defaultdb from indexer A to indexer B

0 Karma

lpolo
Motivator

You could create a cluster as documented in:

http://docs.splunk.com/Documentation/Splunk/5.0.2/Indexer/Aboutclusters

Clusters are groups of Splunk indexers configured to replicate each others' data, so that the system keeps multiple copies of all data. This process is known as index replication. By maintaining multiple, identical copies of Splunk data, clusters prevent data loss while promoting data availability for searching.........

Lp

0 Karma

mship
Path Finder

Thanks for your assistance lpolo but unfortunatley schedule does not allow me the time to implement clustering. I will definitley keep your advice in my pocket as a possible upgrade in the future.

0 Karma

lpolo
Motivator

The number of servers is determine by the replication factor.
For example, if you want to ensure that your system can handle the failure of two peer nodes, you must configure a replication factor of 3, which means that the cluster stores three identical copies of your data on separate nodes. If two peers go down, the data is still available on a third peer.

0 Karma

mship
Path Finder

But if I am not mistaken you need at lease 4 or 5 servers for a cluster...I only have 2.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...