Understanding indexer clusters
A Splunk indexer cluster is a group of two or more indexers that work together to ensure that data is available to the users even in the event of node failures. In this section, we will explore how Splunk indexer clusters work. We will look at the components of a Splunk indexer cluster, review how indexing and searching work in an indexer cluster, and explore the concept of search and replication factors.
To understand the importance of a cluster, let’s explore what happens when we have standalone indexers. Let’s consider a simple scenario, as depicted in Figure 9.2:
Figure 9.2 – Example of unclustered Splunk indexers
There are two forwarders (fw1 and fw2) and three indexers (idx1, idx2, and idx3) in this scenario. Forwarder fw1 forwards Windows event logs and IIS logs to indexers idx1 and idx2, respectively. Forwarder fw2 forwards firewall logs to indexer idx3. There is no sharing of information...
