Splunk Search

Splunk HA architecture using SAN

KomalSharma
Explorer

Hello everyone,

I am referring to the HA option using SAN as explained in this document.

http://docs.splunk.com/Documentation/Splunk/latest/Installation/Highavailabilityreferencearchitectur...

I am wondering if anyone has implemented HA using SAN and if so, can you please share your experience?
Reading through older posts it looks like the data replication seems to be the preferred way.
Is there any distinct advantage of one method v/s another? We have just started using Splunk and want to do some analysis before commiting to our production setup.

Thanks,
Komal

Tags (1)

Damien_Dallimor
Ultra Champion

The SAN overview in that link describes an HA scenario by which you remount a single SAN volume onto a failover server instance when a primary server instance goes down.

There is also another SAN architecture that you can use to achieve an HA and DR position whereby you can enable SAN replication to your DR site. This is my preferred approach.

The alternative approach by using Splunk functionality is configuring your Splunk Forwarders to "auto load balance" and "data clone" over your primary and DR Indexer Clusters, which has additional license cost implications.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...