Getting Data In
Highlighted

How to configure 2 Universal Forwarder instances (Splunk 6.1.3 and 6.3.0) on a single AIX machine?

Communicator

Hi All,

I am planning to configure two Splunk Universal Forwarder instances on one of our AIX machines. Version of Splunk 6.1.3 & 6.3.0.

What are the places that I need to make changes in order to make the two instances run with out any issues?

I have changed the web.conf by changing the management ports.

Help in this regard is very helpful.

Regards,

Highlighted

Re: How to configure 2 Universal Forwarder instances (Splunk 6.1.3 and 6.3.0) on a single AIX machine?

Influencer

I don't know if there are any AIX specific issues.
On linux we just change management port and it works fine.

Highlighted

Re: How to configure 2 Universal Forwarder instances (Splunk 6.1.3 and 6.3.0) on a single AIX machine?

Communicator

Hi jplumsdaine22,

Everything working fine on Linux machines in our environment, but not on AIX machine.

Message : Multiple services cannot be run
Looks like we need to change the subsystem name, not sure just a guess

0 Karma
Highlighted

Re: How to configure 2 Universal Forwarder instances (Splunk 6.1.3 and 6.3.0) on a single AIX machine?

Influencer

Sorry to hear that. Where is that message coming from? Splunk or AIX ?

0 Karma
Highlighted

Re: How to configure 2 Universal Forwarder instances (Splunk 6.1.3 and 6.3.0) on a single AIX machine?

Communicator

Below is the message I am getting after starting second splunk instance:

Multple instances cannot run..

0 Karma
Highlighted

Re: How to configure 2 Universal Forwarder instances (Splunk 6.1.3 and 6.3.0) on a single AIX machine?

Influencer

Oh - Are you starting the instances in seperate locations ? For example

/opt/splunk-instance-1/bin/splunk and /opt/splunk-instance-2/bin/splunk

0 Karma
Highlighted

Re: How to configure 2 Universal Forwarder instances (Splunk 6.1.3 and 6.3.0) on a single AIX machine?

Communicator

yes both instances are in different locations:

0513-029 The splunkd sybsytem is already active.
Multiple instances are not supported.

This is the message I am getting.

0 Karma
Highlighted

Re: How to configure 2 Universal Forwarder instances (Splunk 6.1.3 and 6.3.0) on a single AIX machine?

Influencer

Must be something AIX specific. Have you tried splunk support?

0 Karma
Highlighted

Re: How to configure 2 Universal Forwarder instances (Splunk 6.1.3 and 6.3.0) on a single AIX machine?

Esteemed Legend

If you are planning to manage the instances from a Deployment Server, you need to make sure each instance EITHER uses a separate NIC (so you can say DottedQuad1 is instance1 and gets certain stuff and DottedQuad2 is instance2 and gets other stuff) OR you need to set clientName differently between the two instances inside deploymentclient.conf:

clientName = deploymentClient
    * Defaults to deploymentClient.
    * A name that the deployment server can filter on.
    * Takes precedence over DNS names.

http://docs.splunk.com/Documentation/Splunk/6.3.1511/admin/Deploymentclientconf

0 Karma
Highlighted

Re: How to configure 2 Universal Forwarder instances (Splunk 6.1.3 and 6.3.0) on a single AIX machine?

Communicator

Hi woodcock,

Below is the message that I am getting when running second instance:

0513-029 The splunkd sybsytem is already active.
Multiple instances are not supported.

0 Karma