Dashboards & Visualizations

Splunk design question

naomibn
Explorer

Hello everyone,

I have a requirement where I have three servers in PROD and three in DR. UF agents are installed on all these servers.

All the logs to be monitored will be stored in a NFS. The scenario is like

UF01,UF02,UF03 (PROD) ----- >> monitoring same files in NFS
UF04,UF05,UF06 (DR) ----- >> monitoring same files in NFS

At one point of time there should be only one UF monitoring all these files. If UF01 goes down, either UF02 or UF03 should monitor the NFS.

Is there some kind of a watch mechanism available anywhere.

Thanks,
Nao

Tags (1)
0 Karma
1 Solution

naomibn
Explorer

We tested it. We can utilize the fishbucket folder for this.

View solution in original post

0 Karma

naomibn
Explorer

We tested it. We can utilize the fishbucket folder for this.

0 Karma

jplumsdaine22
Influencer

UFs cannot share state with one another. If you monitor the same NFS path with three different UFs you will get triplicated results.

Where are the logs being generated? It would be better to run the UF on the host that is generating the logs, that way you don't need to deal with any NFS issues.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...