Just noticed I have a duplicate GUID for two standalone, load balanced (via splunk conf, not F5) indexers.
Can I just delete /opt/splunk/etc/instance.cfg and restart one of the indexers, or will that cause some issues?
Well, not sure if this the right answer, but I gave it a try (splunk stop;rm /opt/splunk/etc/instance.cfg; splunk start) and everything seems to be fine.
Well, not sure if this the right answer, but I gave it a try (splunk stop;rm /opt/splunk/etc/instance.cfg; splunk start) and everything seems to be fine.
