1 Decoder to Multiple Concentrators

[VishamRawat]

Can we have multiple Concentrators aggregating from 1 Decoder? I hope this doesn't result in duplication of events? If we have let's say 2 Concentrators aggregate from a Decoder actively, only those events which haven't been picked up by Concentrator 1 will be available to Concentrator 2, right?

Please help clarify.

[DaveGlover]

Visham

If you simply connect a decoder to two or more concentrators you will duplicate all data. Since each concentrator has no knowledge of the other.

If you configure your multiple concentrators in a ‘gang’ config then they will work together and not duplicate any data. In addition you will also have increased performance as you now have a cluster of concentrators

Dave

[Anonymous]

Yes, multiple Concentrators can aggregate metadata from a single Decoder.  Review Concentrator teaming.  When Concentrators are teamed no single Concentrator indexes all the metadata.  In rare circumstances it is possible to NOT team Concentrators and both aggregate from a single Decoder.  In the second case this is typically configured such that reoccurring queries for dashboards, or reports, or even ESA do not create resource constraints for ad hoc Investigations.  The Investigators query via the second (duplicate) Concentrator.

[JohnSnider]

Video Link : 33681