I have a situation where two systems will write to the same NFS mounted file based on whichever one is active. I'm trying to figure out the best approach to importing that data. If I put a local agent on both boxes I'm guessing both agents will read the log file independently and I will get duplicate events in Splunk. The other end of the spectrum is I install the agent on just one box and figure that in cases where that box is rebooted it should still have access to the file (even if it isn't the primary box at that point) and it will simply pickup where it left off indexing the file.
Has anyone dealt with this sort of situation before and if so I'd be interested in hearing how you addressed it.