topic Re: Can we run multiple universal forwarder instance on one Windows server? in Getting Data In

Can we run multiple universal forwarder instance on one Windows server?

nikhilagrawal — Fri, 21 Jun 2013 14:45:29 GMT

We have situation where other team want to manage their own instance of universal forwarder on the same Windows box. Is it possible to run multiple forwarder under different dir on Windows box?

Thanks
Nik

Re: Can we run multiple universal forwarder instance on one Windows server?

aholzer — Fri, 21 Jun 2013 21:29:29 GMT

Why have two separate instances of the forwarder, when you could have two separate apps on the forwarder, one app per team? This way you'd have both teams be able to manage their own configurations, and you wouldn't need two separate instances.

Just make sure you don't define two separate "default groups" in your outputs.conf because it will cause problems.

If it came down to needing a restart intraday I could understand. Although, you wouldn't lose data since the forwarder tracks the last events it sends and would continue from there.

Hope this helps, even if it isn't an answer

Re: Can we run multiple universal forwarder instance on one Windows server?

starcher — Sat, 22 Jun 2013 00:04:56 GMT

I agree, why two instances? I would make two apps each sends to different indexes. And the two groups can see their own index but not the others.

Re: Can we run multiple universal forwarder instance on one Windows server?

linu1988 — Sat, 22 Jun 2013 19:22:31 GMT

Agreed, moreover splunk wont be able to install two instances i suppose