Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: If we clone a Windows server with a Splunk for...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
HI,
I think this is a rather silly question, but I haven't been working with Splunk for too long and just can't figure it out.
We just cloned a Windows box (server1) that has a Splunk forwarder installed that is sending data to Splunk. The clone: server2 has everything server1 had, including the Splunk Forwarder. My question is, how to get the Server2 talking to Splunk and sending Data to Splunk? I cannot locate a file where IPs/Hostnames of Forwarding servers are configured.
When I check under Forwarder Management in the SPLUNK UI, Server2 isn't even being recognized.
Oliver
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ideally you want to run the "./splunk clone-prep-clear-config" command as referenced in the Splunk documentation before cloning the server. You can reference this answer to get an idea how to clean up the servername/GUID on the existing clone to get it to generate a new one.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ideally you want to run the "./splunk clone-prep-clear-config" command as referenced in the Splunk documentation before cloning the server. You can reference this answer to get an idea how to clean up the servername/GUID on the existing clone to get it to generate a new one.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ideally you want to run the "./splunk clone-prep-clear-config" command as referenced in the Splunk documentation "http://docs.splunk.com/Documentation/Splunk/6.3.1/Forwarding/Makeadfpartofasystemimage" before cloning the server. You can reference this answer "https://answers.splunk.com/answers/32368/duplicate-guids-for-cloned-forwarders-how-to-correct.html" to get an idea how to clean up the servername/GUID on the existing clone to get it to generate a new one.
Edit: Hurray for links not working for me!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you, I will try that!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It did not show up however, I am suspecting it has to do with the server.conf file on the cloned server.
On the cloned server I have exactly the same server,conf file under system/local with the same generated key. Might this be the problem why it couldn't be recognized on the DS ?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Casting Call: Compete in Cyber Games
Data Management Digest – June 2026
Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...
