This exercise is a set of Splunk Instances to ensure high availability for your Splunk data, you can deploy an indexer cluster. Indexer clusters are groups of indexers configured to replicate each others’ data, so that the system keeps multiple copies of all data. This process is known as index replication. Indexer clusters prevent data loss while promoting data availability for searching. Indexer clusters can also be simpler to manage than groups of individual indexers.
Deploying Splunk in HA index clustering is bit tricky if we don’t understand the context how splunk actually developed it. We need atleast one Master node, one Search head and one or many indexer (Peer Node). The basic idea is to sync index data across indexer, so if one indexer down we still have the searchable data.
Search head clusters – A search head cluster is a group of search heads that serves as a central resource for searching. The search heads share knowledge objects, apps, and all other configurations.
Forwarder – Splunk instances that forward data to remote indexers for data processing and storage. in this scenario Data input directly in Indexer
Deployer – Splunk Deployer used to distribute apps and certain other configuration updates to search head cluster members. The set of updates that the deployer distributes is called the configuration bundle.
Scope of this LAB is to learn and evaluate High availability deployment and Indexer cluster.
All access to lab systems takes place through a browser type interface. In some labs the deployed cloud will include several instances. Access to secondary instances will take place through the browser interface using SSH from one virtual instance to another.
The suggested and tested browser to use is Chrome, although others may work. The course material includes a URL for lab access. You will use your eCyLabs login and password to gain access. After successfully logging in you will be presented a new page and a virtual machine instance will be created.
Interested in eCyLabs training but don’t know where to start? Just tell us a little bit about yourself, and we’ll make sure the right eCyLabs reaches out.