Splunk when deployed in a clustered and distributed environment is now introduced with various enhancements in Splunk 6.4 for higher efficiency and fault tolerance.
The following are the enhancements introduced in Splunk 6.4:
The index now supports replication of data model and report acceleration summaries. Until Splunk 6.3, if the index failed, the data model and report acceleration summaries were required to be regenerated. In Splunk 6.4, depending on the replication factor, the data model and report acceleration will also be replicated to survive failures.
In case of overheads or nonperformance of any indexer, the index can be quarantined. This feature restricts any new searches using this indexer, whereas any running searches will continue till the index search gets completed.
The search head now supports replication of the search peer. This feature enables us to add any nonclustered indexers to a search head cluster. Search head enhancement in Splunk...
