Modular inputs High Availability

[IgorB]

We've got a modular input polling an external data source via REST API,running on one of the heavy forwarders in the deployment.
We'd like to ensure that the input "migrates" to another Splunk instance if the forwarder goes down.

Ideas?

[dwaddle]

Sounds like a good use for a traditional cluster monitor type solution using shared backend disk. Your fundamental requirements are that the application only run on one server at a time, and that the state of the application is maintained in the event of a failure. This pretty much calls for some kind of cluster monitor.... and yes it's a pain to set up.