Getting Data In
Provide Splunk Cloud feedback in this confidential UX survey by June 17
for a chance to win a $200 Amazon gift card!

Universal forwarders ingestion behind F5 LB

giuces
Engager

Hi guys,

I should find a solution to ingest a file on a network share that is managed from two server behind a load balancer. In my case i should install an UF on every server and check the same file, if i have well understood the UF has not a kind of cluster/balancing awareness so if the file is updated from one server i risk to have the same data ingested from both of them.
How i can manage this kind of behaviour and avoid that new data is ingested from the temporary passive server ?

Unfortunately i cannot use a third server to monitor the file and bypass the issue.

Thanks

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There is no workaround, which is why Splunk explicitly advises against monitoring the same directory/file by more than one forwarder.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If the file is available from both servers then only 1 UF needs to monitor it.  The other UF must not monitor the same file or duplicate data is likely.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

giuces
Engager

I Rich,

thank you for the reply. It is a valid solution, but in case i have to use UF in both nodes is there a possible workaround ?

thanks and regards

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is no workaround, which is why Splunk explicitly advises against monitoring the same directory/file by more than one forwarder.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

giuces
Engager

thank you, i accepted the solution. I hope it is the right way to upvote it.

0 Karma

richgalloway
SplunkTrust
SplunkTrust
Accepting is good to mark a problem as solved so someone can find solutions in the future.
Upvote means clicking the Karma button.
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!