topic Re: How to configure 2 Universal Forwarder instances (Splunk 6.1.3 and 6.3.0) on a single AIX machine? in Getting Data In

How to configure 2 Universal Forwarder instances (Splunk 6.1.3 and 6.3.0) on a single AIX machine?

bharathkumarnec — Tue, 08 Dec 2015 07:51:32 GMT

Hi All,

I am planning to configure two Splunk Universal Forwarder instances on one of our AIX machines. Version of Splunk 6.1.3 & 6.3.0.

What are the places that I need to make changes in order to make the two instances run with out any issues?

I have changed the web.conf by changing the management ports.

Help in this regard is very helpful.

Regards,

Re: How to configure 2 Universal Forwarder instances (Splunk 6.1.3 and 6.3.0) on a single AIX machine?

jplumsdaine22 — Tue, 08 Dec 2015 11:31:03 GMT

I don't know if there are any AIX specific issues.
On linux we just change management port and it works fine.

Re: How to configure 2 Universal Forwarder instances (Splunk 6.1.3 and 6.3.0) on a single AIX machine?

bharathkumarnec — Tue, 08 Dec 2015 11:39:31 GMT

Hi jplumsdaine22,

Everything working fine on Linux machines in our environment, but not on AIX machine.

Message : Multiple services cannot be run
Looks like we need to change the subsystem name, not sure just a guess

Re: How to configure 2 Universal Forwarder instances (Splunk 6.1.3 and 6.3.0) on a single AIX machine?

jplumsdaine22 — Tue, 08 Dec 2015 12:15:59 GMT

Sorry to hear that. Where is that message coming from? Splunk or AIX ?

Re: How to configure 2 Universal Forwarder instances (Splunk 6.1.3 and 6.3.0) on a single AIX machine?

bharathkumarnec — Tue, 08 Dec 2015 13:15:14 GMT

Below is the message I am getting after starting second splunk instance:

Multple instances cannot run..

Re: How to configure 2 Universal Forwarder instances (Splunk 6.1.3 and 6.3.0) on a single AIX machine?

jplumsdaine22 — Tue, 08 Dec 2015 13:44:49 GMT

Oh - Are you starting the instances in seperate locations ? For example

/opt/splunk-instance-1/bin/splunk and /opt/splunk-instance-2/bin/splunk

Re: How to configure 2 Universal Forwarder instances (Splunk 6.1.3 and 6.3.0) on a single AIX machine?

bharathkumarnec — Tue, 08 Dec 2015 14:06:19 GMT

yes both instances are in different locations:

0513-029 The splunkd sybsytem is already active.
Multiple instances are not supported.

This is the message I am getting.

Re: How to configure 2 Universal Forwarder instances (Splunk 6.1.3 and 6.3.0) on a single AIX machine?

jplumsdaine22 — Tue, 08 Dec 2015 14:14:09 GMT

Must be something AIX specific. Have you tried splunk support?

Re: How to configure 2 Universal Forwarder instances (Splunk 6.1.3 and 6.3.0) on a single AIX machine?

woodcock — Wed, 09 Dec 2015 08:27:02 GMT

If you are planning to manage the instances from a Deployment Server, you need to make sure each instance EITHER uses a separate NIC (so you can say DottedQuad1 is instance1 and gets certain stuff and DottedQuad2 is instance2 and gets other stuff) OR you need to set clientName differently between the two instances inside deploymentclient.conf:

clientName = deploymentClient
    * Defaults to deploymentClient.
    * A name that the deployment server can filter on.
    * Takes precedence over DNS names.

http://docs.splunk.com/Documentation/Splunk/6.3.1511/admin/Deploymentclientconf

Re: How to configure 2 Universal Forwarder instances (Splunk 6.1.3 and 6.3.0) on a single AIX machine?

bharathkumarnec — Thu, 10 Dec 2015 10:19:36 GMT

Hi woodcock,

Below is the message that I am getting when running second instance:

0513-029 The splunkd sybsytem is already active.
Multiple instances are not supported.

Re: How to configure 2 Universal Forwarder instances (Splunk 6.1.3 and 6.3.0) on a single AIX machine?

woodcock — Fri, 11 Dec 2015 00:44:47 GMT

I will admit, the last time that I did this was on 6.0 and it was possible. It is entirely possible that between that release and whatever you are using that Splunk has written extra code into splunkd to disable this architectural approach. I would open a support case.

Re: How to configure 2 Universal Forwarder instances (Splunk 6.1.3 and 6.3.0) on a single AIX machine?

woodcock — Fri, 11 Dec 2015 00:45:30 GMT

You do have to run it on a different port but that does not appear to be the problem that you are experiencing.

Re: How to configure 2 Universal Forwarder instances (Splunk 6.1.3 and 6.3.0) on a single AIX machine?

bharathkumarnec — Fri, 11 Dec 2015 07:48:47 GMT

Thanks & yes I am running two instances on two different ports!

Re: How to configure 2 Universal Forwarder instances (Splunk 6.1.3 and 6.3.0) on a single AIX machine?

justinrowan — Thu, 26 Oct 2017 14:57:49 GMT

bharathkumarnec did you find a resolution for this? I'm running into the same issue on AIX 7.1 while attempting to install multiple forwarders.

Works fine on Linux.

Re: How to configure 2 Universal Forwarder instances (Splunk 6.1.3 and 6.3.0) on a single AIX machine?

bharathkumarnec — Fri, 27 Oct 2017 02:50:06 GMT

No!Dint find any!