VCS Cluster and Splunk

[_gkollias]

Hi Splunk,

I have a series of hosts that have been built on (VCS) HA clusters, and I'd like to get them forwarded in to Splunk,

Is it best practices to remove them from the cluster and have them built locally? The main concern I have is if /splunk fails over to its failover node.

I'm hoping one might know the best practice in this situation.

Thank you!

[jtrucks · Accepted solution]

Based on my previous experience with VCS and recent experience with Splunk, I would put each host's Splunk install into a different directory so they can run separately, OR I would exempt Splunk from failover as a service and have each host run it's own local forwarder. This way if services fail over, you continue to get logs from the right places with the right underlying hostname correct for the machine sending logs.

[_gkollias]

Thank you!