Getting Data In

Replicate VM Splunk to second VM

kmattern
Builder

We are planning on having two instances of Splunk running in different geographical locations. The machines will be part of mirrored server farms. Can we take a snapshot of the primary Splunk implementation and mount it on the second machine? Specifically, can we rename the new host without difficulty?

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Yes you can, as long as it is a true snapshot. The host names in Splunk will be in etc/system/inputs.conf and etc/system/server.conf, plus any other places you might have configured it. Any indexed data that references the local host name will still have the same host name when replicated, and that can not be easily changed, so you might want to use a logical/virtual host name in inputs.conf to manage this.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

Yes you can, as long as it is a true snapshot. The host names in Splunk will be in etc/system/inputs.conf and etc/system/server.conf, plus any other places you might have configured it. Any indexed data that references the local host name will still have the same host name when replicated, and that can not be easily changed, so you might want to use a logical/virtual host name in inputs.conf to manage this.

Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...