If we clone a Windows server with a Splunk forwarder installed, how do we configure the the cloned server to send data to Splunk?

[omuelle1]

HI,

I think this is a rather silly question, but I haven't been working with Splunk for too long and just can't figure it out.

We just cloned a Windows box (server1) that has a Splunk forwarder installed that is sending data to Splunk. The clone: server2 has everything server1 had, including the Splunk Forwarder. My question is, how to get the Server2 talking to Splunk and sending Data to Splunk? I cannot locate a file where IPs/Hostnames of Forwarding servers are configured.

When I check under Forwarder Management in the SPLUNK UI, Server2 isn't even being recognized.

Oliver

[bdahlb · Accepted solution]

Ideally you want to run the "./splunk clone-prep-clear-config" command as referenced in the Splunk documentation before cloning the server. You can reference this answer to get an idea how to clean up the servername/GUID on the existing clone to get it to generate a new one.

[bdahlb]

Ideally you want to run the "./splunk clone-prep-clear-config" command as referenced in the Splunk documentation "http://docs.splunk.com/Documentation/Splunk/6.3.1/Forwarding/Makeadfpartofasystemimage" before cloning the server. You can reference this answer "https://answers.splunk.com/answers/32368/duplicate-guids-for-cloned-forwarders-how-to-correct.html" to get an idea how to clean up the servername/GUID on the existing clone to get it to generate a new one.

Edit: Hurray for links not working for me!

[omuelle1]

Thank you, I will try that!

[omuelle1]

It did not show up however, I am suspecting it has to do with the server.conf file on the cloned server.

On the cloned server I have exactly the same server,conf file under system/local with the same generated key. Might this be the problem why it couldn't be recognized on the DS ?