https://community.splunk.com/t5/Installation/EC2-from-AMI-having-splunk-installed-stops-working/m-p/669637#M13419 <P>Hi</P><P>How you have installed your splunk into your AMI and how you have configured it before you have created AMI from that EC2 node?</P><P>I suppose that you haven't clear GUID for that instance before you created it as AMI?</P><P>Here is instructions how to do it for Windows UF clients&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/latest/Admin/Integrateauniversalforwarderontoasystemimage" target="_self">https://docs.splunk.com/Documentation/Splunk/latest/Admin/Integrateauniversalforwarderontoasystemimage</A></P><P>Unfortunately I'm afraid that this is not working on Linux? But you could try to the next</P><UL><LI>Clean event data<UL><LI>splunk stop</LI><LI>splunk clean eventdata</LI></UL></LI><LI>remove $SPLUNK_HOME/etc/instance.cfg</LI><LI>remove current hostname etc. from $SPLUNK_HOME/etc/system/local/*.conf files</LI></UL><P>Probably something else is also needed and if you have anything specific you should add/remove those based on your needs.</P><P>Anther option (even better) is use as standard AMI without splunk part and have some automation which installs needed splunk UF version and needed configurations always when you launch a new EC2 node.&nbsp;</P><P>r. Ismo</P> Fri, 24 Nov 2023 12:35:02 GMT isoutamo 2023-11-24T12:35:02Z https://community.splunk.com/t5/Installation/EC2-from-AMI-having-splunk-installed-stops-working/m-p/669633#M13418 <P>I've set up Splunk on one of my EC2 instances and created an AMI from it. However, when I launch new EC2 instances using this AMI, Splunk stops working on the original EC2 instance. What could be causing this issue? And it is not working on the new machine also.</P> Fri, 24 Nov 2023 12:08:26 GMT https://community.splunk.com/t5/Installation/EC2-from-AMI-having-splunk-installed-stops-working/m-p/669633#M13418 pavanbhatt 2023-11-24T12:08:26Z https://community.splunk.com/t5/Installation/EC2-from-AMI-having-splunk-installed-stops-working/m-p/669637#M13419 <P>Hi</P><P>How you have installed your splunk into your AMI and how you have configured it before you have created AMI from that EC2 node?</P><P>I suppose that you haven't clear GUID for that instance before you created it as AMI?</P><P>Here is instructions how to do it for Windows UF clients&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/latest/Admin/Integrateauniversalforwarderontoasystemimage" target="_self">https://docs.splunk.com/Documentation/Splunk/latest/Admin/Integrateauniversalforwarderontoasystemimage</A></P><P>Unfortunately I'm afraid that this is not working on Linux? But you could try to the next</P><UL><LI>Clean event data<UL><LI>splunk stop</LI><LI>splunk clean eventdata</LI></UL></LI><LI>remove $SPLUNK_HOME/etc/instance.cfg</LI><LI>remove current hostname etc. from $SPLUNK_HOME/etc/system/local/*.conf files</LI></UL><P>Probably something else is also needed and if you have anything specific you should add/remove those based on your needs.</P><P>Anther option (even better) is use as standard AMI without splunk part and have some automation which installs needed splunk UF version and needed configurations always when you launch a new EC2 node.&nbsp;</P><P>r. Ismo</P> Fri, 24 Nov 2023 12:35:02 GMT https://community.splunk.com/t5/Installation/EC2-from-AMI-having-splunk-installed-stops-working/m-p/669637#M13419 isoutamo 2023-11-24T12:35:02Z https://community.splunk.com/t5/Installation/EC2-from-AMI-having-splunk-installed-stops-working/m-p/670644#M13437 <P>Thank you for your response; it pointed me in the right direction.</P> Mon, 04 Dec 2023 14:09:01 GMT https://community.splunk.com/t5/Installation/EC2-from-AMI-having-splunk-installed-stops-working/m-p/670644#M13437 pavanbhatt 2023-12-04T14:09:01Z