Getting Data In

VCS Cluster and Splunk

_gkollias
Builder

Hi Splunk,

I have a series of hosts that have been built on (VCS) HA clusters, and I'd like to get them forwarded in to Splunk,

Is it best practices to remove them from the cluster and have them built locally? The main concern I have is if /splunk fails over to its failover node.

I'm hoping one might know the best practice in this situation.

Thank you!

Tags (2)
1 Solution

jtrucks
Splunk Employee
Splunk Employee

Based on my previous experience with VCS and recent experience with Splunk, I would put each host's Splunk install into a different directory so they can run separately, OR I would exempt Splunk from failover as a service and have each host run it's own local forwarder. This way if services fail over, you continue to get logs from the right places with the right underlying hostname correct for the machine sending logs.

--
Jesse Trucks
Minister of Magic

View solution in original post

jtrucks
Splunk Employee
Splunk Employee

Based on my previous experience with VCS and recent experience with Splunk, I would put each host's Splunk install into a different directory so they can run separately, OR I would exempt Splunk from failover as a service and have each host run it's own local forwarder. This way if services fail over, you continue to get logs from the right places with the right underlying hostname correct for the machine sending logs.

--
Jesse Trucks
Minister of Magic

_gkollias
Builder

Thank you!

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...