I think this is a rather silly question, but I haven't been working with Splunk for too long and just can't figure it out.
We just cloned a Windows box (server1) that has a Splunk forwarder installed that is sending data to Splunk. The clone: server2 has everything server1 had, including the Splunk Forwarder. My question is, how to get the Server2 talking to Splunk and sending Data to Splunk? I cannot locate a file where IPs/Hostnames of Forwarding servers are configured.
When I check under Forwarder Management in the SPLUNK UI, Server2 isn't even being recognized.
It did not show up however, I am suspecting it has to do with the server.conf file on the cloned server.
On the cloned server I have exactly the same server,conf file under system/local with the same generated key. Might this be the problem why it couldn't be recognized on the DS ?
Ideally you want to run the "./splunk clone-prep-clear-config" command as referenced in the Splunk documentation "http://docs.splunk.com/Documentation/Splunk/6.3.1/Forwarding/Makeadfpartofasystemimage" before cloning the server. You can reference this answer "https://answers.splunk.com/answers/32368/duplicate-guids-for-cloned-forwarders-how-to-correct.html" to get an idea how to clean up the servername/GUID on the existing clone to get it to generate a new one.
Edit: Hurray for links not working for me!
Thank you, I will try that!