How to install the Universal Forwarder on a Windows Cluster

[jasonstone]

I haven't been able to find a clear post on "How to install the Universal Forwarder on a Windows Cluster".
Does anyone know what the best practices are?

Thanks

[bsherwoodofdapt]

(for people who fall onto this question looking for similar information)

I would say it this way:

Treat your cluster as what it really is. Multiple physical nodes. Place a forwarder on each physical node.

You don't get the data specific to the virtualized service in the cluster, you just get data for the physical nodes. You can deduce on your own which server may host the virtual service at the time.

This is what I am doing with my Windows 2k8 Failover Cluster. There has been no manipulation or installation of the forwarder within the cluster configuration, since there really is no value to that. (This is even more important to realize if you are running Active/Active clusters where each node is important enough to monitor separately)

[rsennett_splunk]

Have you read this section?

http://docs.splunk.com/Documentation/Splunk/5.0.2/Indexer/Useforwarderstogetyourdata

Best Practices for Cluster/Forwarder set-up mentioned throughout.