Getting Data In

Splunk light weight forwarder failover capability

ajaybguthi
Explorer

Hi,

Do we have a fail over capability for any Splunk forwarders? like if one forwarder goes down the other one will pickup and start reading the files where the other forwarder stopped

Tags (1)

dwaddle
SplunkTrust
SplunkTrust

Multiple forwarders on the same machine reading and forwarding the same files is a disaster waiting to happen. Each forwarder keeps a database of what files it has seen and how far into them it has forwarded. A "fail over" forwarder running on the same machine would very likely result in lots of duplicate events.

I would try to think of the Splunk forwarder as an agent. You don't run "fail over" antivirus software, or "fail over" ssh daemons. As bosburn suggests, watching inactive forwarders via deployment monitor or a watchdog to restart a forwarder if it does crash makes sense. But don't overcomplicate it.

bosburn_splunk
Splunk Employee
Splunk Employee

This functionality is not included in the base Splunk forwarder install. You could use deployment monitor app to watch for forwarders that stop sending data, or write a watchdog script that will keep an eye out on the Splunk process and restart it if it crashes.

piebob
Splunk Employee
Splunk Employee

inb4--oh dammit.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

first upgoat!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...