https://community.splunk.com/t5/Getting-Data-In/universal-forwarders-in-cluster-failover/m-p/140499#M28813 <P>The "bookmark" for where a Splunk forwarder left off ingesting monitored files is in the fishbucket "index". If you rsync this folder ($SPLUNK_DB/fishbucket) between the forwarders, they should fail over / fail back gracefully, without <EM>too much</EM> duplication.</P> Thu, 16 Jan 2014 17:19:58 GMT sowings 2014-01-16T17:19:58Z https://community.splunk.com/t5/Getting-Data-In/universal-forwarders-in-cluster-failover/m-p/140498#M28812 <P>Hello,</P> <P>We have two linux syslog servers setup in a cluster receiving syslog feeds. When one of the servers goes down the syslogging gets failed over to the secondary server and the agent gets automatically when failed over then stopped when failed back over to the primary. One of the issues we are having is when it fails back over to the primary it ingests duplicate data. What is the best way to handle universal forwarders in a cluster to eliminate duplicates and for the agent to continue indexing where it left off?</P> Wed, 13 Nov 2013 15:22:47 GMT https://community.splunk.com/t5/Getting-Data-In/universal-forwarders-in-cluster-failover/m-p/140498#M28812 aaronkorn 2013-11-13T15:22:47Z https://community.splunk.com/t5/Getting-Data-In/universal-forwarders-in-cluster-failover/m-p/140499#M28813 <P>The "bookmark" for where a Splunk forwarder left off ingesting monitored files is in the fishbucket "index". If you rsync this folder ($SPLUNK_DB/fishbucket) between the forwarders, they should fail over / fail back gracefully, without <EM>too much</EM> duplication.</P> Thu, 16 Jan 2014 17:19:58 GMT https://community.splunk.com/t5/Getting-Data-In/universal-forwarders-in-cluster-failover/m-p/140499#M28813 sowings 2014-01-16T17:19:58Z