Getting Data In

High availability for HF scripts


I have a pair of HFs located in a DMZ that can collect data from the Internet via a script input.
All other Splunk instances (indexers, SHs, deployment server etc) are firewalled from the Internet.
Only one of the HFs can run the input for any collection period as the data is large and duplicate events would not be acceptable so running the script on both HFs isn't suitable.
At present I configure the input on just one of the HFs but I'd like to be able to have the script automatically executed by either HF in case of HF failure.
Has anyone solved this problem?

Thanks ...Laurie:{)

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...