Splunk Search

Design question

naomibn
Explorer

Hello everyone,

I have a requirement where I have three servers in PROD and three in DR. UF agents are installed on all these servers.

All the logs to be monitored will be stored in a NFS. The scenario is like

UF01,UF02,UF03 (PROD) ----- >> monitoring same files in NFS
UF04,UF05,UF06 (DR) ----- >> monitoring same files in NFS

At one point of time there should be only one UF monitoring all these files. If UF01 goes down, either UF02 or UF03 should monitor the NFS.

Is there some kind of a watch mechanism available anywhere.

Thanks,
Nao

Tags (1)
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...