Hey everyone, I am running into some issues right now. I have a dedicated forwarding machine which has 5 instances of the universal forwarder (our tech support rep from splunk stated that the individual forwarders are limited on their throughput, and to handle the amount of data we would have to split it out to several different processes). This was set up in v4 using the method shown here: http://wiki.splunk.com/Community:Run_multiple_Splunks_on_one_machine
I backed up everything in the /opt directory, removed everything in that directory, and installed the new RPM. I created additional 4 copies in the opt directory (/opt/splunkforwarder, /opt/splunkforwarder2.../opt/splunkforwarder5). I copied back in the custom configurations (everything in /opt/splunkforwarder*N*/etc/system/local) to each instance's ~/etc/system/local directory. I also re-installed and reconfigured the startup scripts in /etc/init.d so that there are definitions for splunk through splunk5, each pointing towards a different instance of splunk, and each creating a separate lockfile. With version 4, this had been enough for it to work.
I can open the first instance (/opt/splunkforwarder) but when I try opening /opt/splunkforwarder2 through 5 it tells me that it is already running (using both the direct command path:/opt/splunkforwarder*N*/bin/splunk start, and also when using the /etc/init.d command). When I attempt to check the log /opt/splunkforwarder*n*/var/log/splunk/splunkd.log, the server reports that the file doesn't exist for splunkforwarder2-5.
Any ideas on how to get this back up and running?
