Getting Data In
Highlighted

How to install the Universal Forwarder on a Windows Cluster

Explorer

I haven't been able to find a clear post on "How to install the Universal Forwarder on a Windows Cluster".
Does anyone know what the best practices are?

Thanks

Highlighted

Re: How to install the Universal Forwarder on a Windows Cluster

Splunk Employee
Splunk Employee

Have you read this section?

http://docs.splunk.com/Documentation/Splunk/5.0.2/Indexer/Useforwarderstogetyourdata

Best Practices for Cluster/Forwarder set-up mentioned throughout.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma
Highlighted

Re: How to install the Universal Forwarder on a Windows Cluster

(for people who fall onto this question looking for similar information)

I would say it this way:

Treat your cluster as what it really is. Multiple physical nodes. Place a forwarder on each physical node.

You don't get the data specific to the virtualized service in the cluster, you just get data for the physical nodes. You can deduce on your own which server may host the virtual service at the time.

This is what I am doing with my Windows 2k8 Failover Cluster. There has been no manipulation or installation of the forwarder within the cluster configuration, since there really is no value to that. (This is even more important to realize if you are running Active/Active clusters where each node is important enough to monitor separately)