Advanced Splunk

Indexer and search head enhancement

Splunk when deployed in a clustered and distributed environment is now introduced with various enhancements in Splunk 6.4 for higher efficiency and fault tolerance.

The following are the enhancements introduced in Splunk 6.4:

• The index now supports replication of data model and report acceleration summaries. Until Splunk 6.3, if the index failed, the data model and report acceleration summaries were required to be regenerated. In Splunk 6.4, depending on the replication factor, the data model and report acceleration will also be replicated to survive failures.
• In case of overheads or nonperformance of any indexer, the index can be quarantined. This feature restricts any new searches using this indexer, whereas ...