Splunk indexing servers

[kaboomza]

Hi there,

I wanted to check if other people have experience in backing up splunk indexing servers with high rate of change. I am finding that the time it takes to complete reading the disk to complete the backup is taking extremely long. I would assume its because of the high rate of change and the type of Log data that is stored on this server. anybody else have experience with backing up these types of servers and experience the same type of situation?

[kaboomza]

As you would imagine there is a very high transactional rate of read/writes that happen on these types of servers so I dont see how there is a magic trick to really dodge this kind of situation.

[foggy]

Hi Jaques, I'm not familiar with this particular software, but speaking about backup of a high transactional applications in general - how exactly do you do that? What you take as "extremely long" and what are the consequences of that? During application consistent backup all application activity is typically stopped (quiesced) - a snapshot is taken at the moment when there are no running operations on the server which can be achieved by several methods depending on the application itself.

[skrause]

Are you backing up the indexes on all your indexing servers, or just one of them?

I don't see how you can get away from backing up a huge amount of changes on a single server since a typical splunk installation would be ingesting a large amount of data on a daily basis, but since the application replicates indexes between nodes you shouldn't have to back up the index data from every node in the cluster and then can focus on optimizing performance for the backup of that one indexer.

[wishr]

Hi guys,

I'd suggest taking a look at that article.

Thanks