Getting Data In

steps to move universal forwarder from oracle database server to other without loosing any app config/setting

mahenreddy
New Member

I am new to splunk, can i get advice on moving splunk universal forwarder from one db host to another.
I am looking for options where i don't have to configure whole lot on the target.

I tried SPLUNK HOME tar ball to target server, change the hostname in .conf files. I see the data coming but i don't see the
sourcetype options , tags, dashboards

Thanks

0 Karma
1 Solution

mguhad
Communicator

Hi,
If it is simply a universal forwarder:
1.Ensure that the new db host has the same source paths for the files it is monitoring as the old one
2.Ensure the deployment server is up to date with the client (that way, once the UF phones home under new db host, it can simply push the same app out again to resume service as usual....the caveat being the new db host has the same exact input.conf stanzas as the old db you are moving from)
3. Install the forwarder on the new db host
4. Point the forwarder to the deployment server : ./splunk set deploy-poll <deploymentserver>:8089
5. Once the forwarder is phoning home from the new db host, attach the same apps & serverclass as previous db forwarder and push out to the client - ./splunk reload deploy-server

Once the new forwarder begins to send data to the indexers, the dashboards and other knowledge objects should begin populating as per usual witht the previous setup.

View solution in original post

0 Karma

mguhad
Communicator

Hi,
If it is simply a universal forwarder:
1.Ensure that the new db host has the same source paths for the files it is monitoring as the old one
2.Ensure the deployment server is up to date with the client (that way, once the UF phones home under new db host, it can simply push the same app out again to resume service as usual....the caveat being the new db host has the same exact input.conf stanzas as the old db you are moving from)
3. Install the forwarder on the new db host
4. Point the forwarder to the deployment server : ./splunk set deploy-poll <deploymentserver>:8089
5. Once the forwarder is phoning home from the new db host, attach the same apps & serverclass as previous db forwarder and push out to the client - ./splunk reload deploy-server

Once the new forwarder begins to send data to the indexers, the dashboards and other knowledge objects should begin populating as per usual witht the previous setup.

0 Karma

mahenreddy
New Member

Thanks a lot . Everything is working fine.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

@mahenreddy If your problem is resolved then please accept the answer to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

mahenreddy
New Member

Thanks a lot for detailed reply.

0 Karma

mahenreddy
New Member

Thanks for the detailed step by step explanation . It resolved the issue.

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...