Dashboards & Visualizations

Splunk design question

naomibn
Explorer

Hello everyone,

I have a requirement where I have three servers in PROD and three in DR. UF agents are installed on all these servers.

All the logs to be monitored will be stored in a NFS. The scenario is like

UF01,UF02,UF03 (PROD) ----- >> monitoring same files in NFS
UF04,UF05,UF06 (DR) ----- >> monitoring same files in NFS

At one point of time there should be only one UF monitoring all these files. If UF01 goes down, either UF02 or UF03 should monitor the NFS.

Is there some kind of a watch mechanism available anywhere.

Thanks,
Nao

Tags (1)
0 Karma
1 Solution

naomibn
Explorer

We tested it. We can utilize the fishbucket folder for this.

View solution in original post

0 Karma

naomibn
Explorer

We tested it. We can utilize the fishbucket folder for this.

0 Karma

jplumsdaine22
Influencer

UFs cannot share state with one another. If you monitor the same NFS path with three different UFs you will get triplicated results.

Where are the logs being generated? It would be better to run the UF on the host that is generating the logs, that way you don't need to deal with any NFS issues.

0 Karma
Get Updates on the Splunk Community!

Splunk is Nurturing Tomorrow’s Cybersecurity Leaders Today

Meet Carol Wright. She leads the Splunk Academic Alliance program at Splunk. The Splunk Academic Alliance ...

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...