topic VCS Cluster and Splunk in Getting Data In

VCS Cluster and Splunk

_gkollias — Tue, 08 Oct 2013 14:21:02 GMT

Hi Splunk,

I have a series of hosts that have been built on (VCS) HA clusters, and I'd like to get them forwarded in to Splunk,

Is it best practices to remove them from the cluster and have them built locally? The main concern I have is if /splunk fails over to its failover node.

I'm hoping one might know the best practice in this situation.

Thank you!

Re: VCS Cluster and Splunk

jtrucks — Tue, 08 Oct 2013 19:33:50 GMT

Based on my previous experience with VCS and recent experience with Splunk, I would put each host's Splunk install into a different directory so they can run separately, OR I would exempt Splunk from failover as a service and have each host run it's own local forwarder. This way if services fail over, you continue to get logs from the right places with the right underlying hostname correct for the machine sending logs.

Re: VCS Cluster and Splunk

_gkollias — Tue, 08 Oct 2013 19:37:21 GMT

Thank you!