How to switch between Splunk Universal Fowarders?

[kranthik]

Hi,

We have a production environment and disaster recovery environment, Splunk universal forwarder is installed on both environments. When production system goes down the UF on production system has to be stopped and UF on DR environment has to start and activate the data ingestion to index. Is there any possibility to set up this mechanism? If yes, how to set up or configure this mechanism?

Please let me know if any additional details are required.

Thank you,

Best regards,
KK.

[Javip · Accepted solution]

Hi!

When you say "production system goes down" you mean the server is down and I suppose UF is also down if you enabled automatic start/stop on boot... right? I suppse you used this command to enable it: $SPLUNK_HOME/bin/splunk enable boot-start

Then when your disaster recovery environtment goes up, your UF will start automatically.

Regards,
J.