Dashboards & Visualizations

Splunk design question

naomibn
Explorer

Hello everyone,

I have a requirement where I have three servers in PROD and three in DR. UF agents are installed on all these servers.

All the logs to be monitored will be stored in a NFS. The scenario is like

UF01,UF02,UF03 (PROD) ----- >> monitoring same files in NFS
UF04,UF05,UF06 (DR) ----- >> monitoring same files in NFS

At one point of time there should be only one UF monitoring all these files. If UF01 goes down, either UF02 or UF03 should monitor the NFS.

Is there some kind of a watch mechanism available anywhere.

Thanks,
Nao

Tags (1)
0 Karma
1 Solution

naomibn
Explorer

We tested it. We can utilize the fishbucket folder for this.

View solution in original post

0 Karma

naomibn
Explorer

We tested it. We can utilize the fishbucket folder for this.

0 Karma

jplumsdaine22
Influencer

UFs cannot share state with one another. If you monitor the same NFS path with three different UFs you will get triplicated results.

Where are the logs being generated? It would be better to run the UF on the host that is generating the logs, that way you don't need to deal with any NFS issues.

0 Karma
Get Updates on the Splunk Community!

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk ITSI & Correlated Network Visibility

  Now On Demand   Take Your Network Visibility to the Next Level In today’s complex IT environments, ...