Indexer Clustering Setup and Configuration

In this video I have discussed about how to configure indexer clustering. Indexer clusters are groups of Splunk Enterprise indexers configured to replicate each others' data, so that the system keeps multiple copies of all data. This process is known as index replication. By maintaining multiple, identical copies of Splunk Enterprise data, clusters prevent data loss while promoting data availability for searching.

Indexer clusters feature automatic failover from one indexer to the next. This means that, if one or more indexers fail, incoming data continues to get indexed and indexed data continues to be searchable.
Materials used in this video can be downloaded from the below repo:

[filipkuczak]

Everytime I watch one of Your videos I feel so gratefull for such easy and detailed explanation. Thank You so much for Your amazing work !

[neeraj]

HI Sid, Post the Indexer cluster setup next step is to get the data in. Request to do a video on how to connect Universal forwarders to an Indexer cluster via Indexer discovery.

[nischaldu]

Hi, im getting this error while setting up the indexer clustering Cannot fix search count as the bucket hasn't rolled yet.

[rajivaws]

HI Sir...I have one very basic doubt for which i couldn't've find any answer anywhere...Suppose i have an environment of 10 indexer with RF=3 and SF=3 so does it mean it will have 3 copies of each bucket on each of 10 indexer like idx1 will have 3 copies idx2 will have 3 copies idx 3 will have 3 copies idx4 will have 3 copies idx5 will have 3 copies....idx10 will have 3 copies or is it like 3 copies will be there across all indexers....if 3 copies of each buckets are present across all indexer than how bucket fixing activity will perform in case 5 indexers are down assuming three out of this 5 down indexers will have bucket copies and those indexers which is up will not have any bucket copies. So is it idle to have high RF value in an environment of 10 indexers.

[Hughzhou]

hi， I have to say this is a nice video, but, i would like to know why there is no subtitles, you know, i/m not good at English, I would like to learn details about cluster, I searched for similar videos for a long time until I met you，I want to build the architecture by myself for my study, because i'm a new guys for Splunk, i found there is subtitle in your new video, could you tell me how to find subtitles for this video or is there any way I can see the subtitles? thanks sooo~ much,

[kostralian]

you saved my ass. please keep up the good work

[qawsfgtwgshsghsfdvf]

Nice video. I wish you had made one of peer mode changes via the command line.

[rajam]

Hi sid, if I have indexer with all data which we had earlier, now if i want to change that to indexer cluster as Indexer1 and other two as new indexers 2&3 then data in indexer 1 will get replicated to indexer 2&3 after enabling clustering? I was bit skepticAl that how it works. Please help

[gisellelopez]

Hi Sid. Do you have a tutorial for indexer clustering and search head clustering without opening the Splunk Web UI? Just using the backend -- CLI commands?

[adarshmahi]

Hey Sid, Thanks again for this informative video. Would you like to make a video on splunk upgrade and especially dos & don'ts while upgrading splunk clustered environment in production region..?

[rajkumarkandasamy]

Thanks again for your videos, Quick question, as per your video, free license doesn't meet the replication factor, am i correct. but when we do the indexer clustering, how does the dashboard shows that Rep factor is met? could you please explain this

[divyasetia]

Hi sir, kindly try to create videos on multisite clustering also and also some admin related troubleshooting videos

[karthigeyan]

@splunk_ml Hi Bro, I am thank you for videos which you posting really and easy to understand. I need more videos like,
1. Step by step Upgrade of Splunk version in cluster environment
2.Need more video of ITSI

Thanks,
Karthigeyan R

[grainfrizz]

Here's a tip: once you've successfully configured the indexer clustering, you may (or I should say, must) turn off Splunk Web and Transparent Huge Pages on the indexer peers.

[hanueai]

can you give demo on SEIM administration using SPLUNK ?

[mahindrakalyan]

Hi Admin...First of all thank you very much for the uploads...I am in search of Splunk related videos from past 2 weeks... Yesterday I saw your channel and went though playlists...There I found 81 videos which are related to development...
My query is, I am looking for switching the company, are these 81 videos enough for 2-3 years experience candidate? Or if you suggest anything apart from these 81 videos...
Thank you in advance...

[grainfrizz]

Rep and search factor numbers won't be written on server.conf in system/local because Splunk will just use the one in system/default.

[amith]

Can we deploy this conf via deployment server ?

[cexesp]

thanks for the awesome video, perfect bro

[penchum]

Are you help me to attended the splunk certification exam