EC2 from AMI having splunk installed stops working

[pavanbhatt]

I've set up Splunk on one of my EC2 instances and created an AMI from it. However, when I launch new EC2 instances using this AMI, Splunk stops working on the original EC2 instance. What could be causing this issue? And it is not working on the new machine also.

[isoutamo · Accepted solution]

Hi

How you have installed your splunk into your AMI and how you have configured it before you have created AMI from that EC2 node?

I suppose that you haven't clear GUID for that instance before you created it as AMI?

Here is instructions how to do it for Windows UF clients https://docs.splunk.com/Documentation/Splunk/latest/Admin/Integrateauniversalforwarderontoasystemima...

Unfortunately I'm afraid that this is not working on Linux? But you could try to the next

• Clean event data
  • splunk stop
  • splunk clean eventdata
• remove $SPLUNK_HOME/etc/instance.cfg
• remove current hostname etc. from $SPLUNK_HOME/etc/system/local/*.conf files

Probably something else is also needed and if you have anything specific you should add/remove those based on your needs.

Anther option (even better) is use as standard AMI without splunk part and have some automation which installs needed splunk UF version and needed configurations always when you launch a new EC2 node. 

r. Ismo

[pavanbhatt]

Thank you for your response; it pointed me in the right direction.