Universal forwarders ingestion behind F5 LB

[giuces]

Hi guys,

I should find a solution to ingest a file on a network share that is managed from two server behind a load balancer. In my case i should install an UF on every server and check the same file, if i have well understood the UF has not a kind of cluster/balancing awareness so if the file is updated from one server i risk to have the same data ingested from both of them.
How i can manage this kind of behaviour and avoid that new data is ingested from the temporary passive server ?

Unfortunately i cannot use a third server to monitor the file and bypass the issue.

Thanks

[richgalloway]

If the file is available from both servers then only 1 UF needs to monitor it.  The other UF must not monitor the same file or duplicate data is likely.

[giuces]

I Rich,

thank you for the reply. It is a valid solution, but in case i have to use UF in both nodes is there a possible workaround ?

thanks and regards

[richgalloway · Accepted solution]

There is no workaround, which is why Splunk explicitly advises against monitoring the same directory/file by more than one forwarder.

[giuces]

thank you, i accepted the solution. I hope it is the right way to upvote it.

[richgalloway]

Accepting is good to mark a problem as solved so someone can find solutions in the future.
Upvote means clicking the Karma button.