Hi guys,
I should find a solution to ingest a file on a network share that is managed from two server behind a load balancer. In my case i should install an UF on every server and check the same file, if i have well understood the UF has not a kind of cluster/balancing awareness so if the file is updated from one server i risk to have the same data ingested from both of them.
How i can manage this kind of behaviour and avoid that new data is ingested from the temporary passive server ?
Unfortunately i cannot use a third server to monitor the file and bypass the issue.
Thanks
There is no workaround, which is why Splunk explicitly advises against monitoring the same directory/file by more than one forwarder.
If the file is available from both servers then only 1 UF needs to monitor it. The other UF must not monitor the same file or duplicate data is likely.
I Rich,
thank you for the reply. It is a valid solution, but in case i have to use UF in both nodes is there a possible workaround ?
thanks and regards
There is no workaround, which is why Splunk explicitly advises against monitoring the same directory/file by more than one forwarder.
thank you, i accepted the solution. I hope it is the right way to upvote it.