Hi all!
If I set up a Splunk cluster spanning two datacenters. Machine data sent to indexers local to the datacenter. I have to make sure a copy of the machine data is replicated to the other datacenter.
Reading Managing Indexers and Clusters manual, chapter How clustered indexing works states: “…you cannot currently specify which nodes will receive replicated data.”
On the other hand, server.conf.spec describes the option acceptFrom (replication_port stanza) which “Lists a set of networks or addresses to accept connections from.” My idea is to use this acl to allow connections only from indexers located in the remote datacenter and deny connections from all local indexers.
My question is: Can this acl be used to bypass the limitation “… you cannot currently specify which nodes will receive replicated data.”?
If not, does anyone know if/when this will be available?
How clustered indexing works: http://docs.splunk.com/Documentation/Splunk/5.0.4/Indexer/Howclusteredindexingworks
server.conf.spec: http://docs.splunk.com/Documentation/Splunk/5.0.4/admin/Serverconf
