Dashboards & Visualizations

Splunk design question

naomibn
Explorer

Hello everyone,

I have a requirement where I have three servers in PROD and three in DR. UF agents are installed on all these servers.

All the logs to be monitored will be stored in a NFS. The scenario is like

UF01,UF02,UF03 (PROD) ----- >> monitoring same files in NFS
UF04,UF05,UF06 (DR) ----- >> monitoring same files in NFS

At one point of time there should be only one UF monitoring all these files. If UF01 goes down, either UF02 or UF03 should monitor the NFS.

Is there some kind of a watch mechanism available anywhere.

Thanks,
Nao

Tags (1)
0 Karma
1 Solution

naomibn
Explorer

We tested it. We can utilize the fishbucket folder for this.

View solution in original post

0 Karma

naomibn
Explorer

We tested it. We can utilize the fishbucket folder for this.

0 Karma

jplumsdaine22
Influencer

UFs cannot share state with one another. If you monitor the same NFS path with three different UFs you will get triplicated results.

Where are the logs being generated? It would be better to run the UF on the host that is generating the logs, that way you don't need to deal with any NFS issues.

0 Karma
Get Updates on the Splunk Community!

Announcing the Expansion of the Splunk Academic Alliance Program

The Splunk Community is more than just an online forum — it’s a network of passionate users, administrators, ...

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...