Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: If we clone a Windows server with a Splunk for...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
HI,
I think this is a rather silly question, but I haven't been working with Splunk for too long and just can't figure it out.
We just cloned a Windows box (server1) that has a Splunk forwarder installed that is sending data to Splunk. The clone: server2 has everything server1 had, including the Splunk Forwarder. My question is, how to get the Server2 talking to Splunk and sending Data to Splunk? I cannot locate a file where IPs/Hostnames of Forwarding servers are configured.
When I check under Forwarder Management in the SPLUNK UI, Server2 isn't even being recognized.
Oliver
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ideally you want to run the "./splunk clone-prep-clear-config" command as referenced in the Splunk documentation before cloning the server. You can reference this answer to get an idea how to clean up the servername/GUID on the existing clone to get it to generate a new one.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ideally you want to run the "./splunk clone-prep-clear-config" command as referenced in the Splunk documentation before cloning the server. You can reference this answer to get an idea how to clean up the servername/GUID on the existing clone to get it to generate a new one.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ideally you want to run the "./splunk clone-prep-clear-config" command as referenced in the Splunk documentation "http://docs.splunk.com/Documentation/Splunk/6.3.1/Forwarding/Makeadfpartofasystemimage" before cloning the server. You can reference this answer "https://answers.splunk.com/answers/32368/duplicate-guids-for-cloned-forwarders-how-to-correct.html" to get an idea how to clean up the servername/GUID on the existing clone to get it to generate a new one.
Edit: Hurray for links not working for me!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you, I will try that!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It did not show up however, I am suspecting it has to do with the server.conf file on the cloned server.
On the cloned server I have exactly the same server,conf file under system/local with the same generated key. Might this be the problem why it couldn't be recognized on the DS ?
What Is Splunk? Here’s What You Can Do with Splunk
Level Up Your .conf25: Splunk Arcade Comes to Boston
Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...
