Getting Data In

VCS Cluster and Splunk

_gkollias
Builder

Hi Splunk,

I have a series of hosts that have been built on (VCS) HA clusters, and I'd like to get them forwarded in to Splunk,

Is it best practices to remove them from the cluster and have them built locally? The main concern I have is if /splunk fails over to its failover node.

I'm hoping one might know the best practice in this situation.

Thank you!

Tags (2)
1 Solution

jtrucks
Splunk Employee
Splunk Employee

Based on my previous experience with VCS and recent experience with Splunk, I would put each host's Splunk install into a different directory so they can run separately, OR I would exempt Splunk from failover as a service and have each host run it's own local forwarder. This way if services fail over, you continue to get logs from the right places with the right underlying hostname correct for the machine sending logs.

--
Jesse Trucks
Minister of Magic

View solution in original post

jtrucks
Splunk Employee
Splunk Employee

Based on my previous experience with VCS and recent experience with Splunk, I would put each host's Splunk install into a different directory so they can run separately, OR I would exempt Splunk from failover as a service and have each host run it's own local forwarder. This way if services fail over, you continue to get logs from the right places with the right underlying hostname correct for the machine sending logs.

--
Jesse Trucks
Minister of Magic

_gkollias
Builder

Thank you!

Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...