So you want to basically change the code that calls the sendemail.py routines... Hhmmmm I don't have access to all the information for a definitive answer, but I would assume that the routines calling upon sendemail.py might be (partially) hardcoded into the program and as such unchangeable. Anyone from the development team reading this thread, feel free to chip in.! 🙂 ... View more

Clustering is always just 1 step in reducing your exposure to failures. A cluster will in practice only protect you from technical failures with hardware. It does nothing to prevent logical corruption or other logical issues within the application or its logic. If you would like to have full disaster tolerancy (physical and logical) for you entire Splunk setup, good luck... I doubt it will be possible at all. Maybe when using various techniques combined with true non-stop hardware (HP Non-Stop / Himalaya, type of equipment) clusters, then maybe it is possible but the risk vs benefits vs cost, calculation will be a hard sell within any organisation. Perhaps Splunk US has some reference architecture documentation about the HA solution that Apple is using. ... View more

If you are looking for a high available solution, without OS clustering there is also the option of running a VM. If your virtualization platform is already highly available and you have to option of using it, why not host the cluster manager role on there? Running a hot-standby VM is possible with either VMware ESX, Hyper-V, XenServer and I would assume most other solutions also... and don't forget, Splunk failover functionality is impacted by the loss of the cluster manager, but no 'real' functionality is lost with a momentary loss of the CM. So a hot or warm stand-by CM would probably be enough to meet most HA demands. ... View more

The cluster manager is only handling some basic management tasks, so no real heavy loads. Since combined setups are supported by Splunk, it would not be a problem to only host you Cluster Manager on FO-Cluster and run all 'real' loads on a different OS. Since I am a former MS employee, Windows clustering is within my comfort zone and thus I suggested it. I would however in all fairness have to say, that if you don't have in-depth Windows knowledge and you are already used to working with some other OS, it would of course make more sense to just run a cluster solution based on you own preferred OS. I am however assuming that the concept of a FO-Cluster in Windows, has a equivalent solution (functionality-wise) in the OS you are intending to use. Regards, Martijn (Omni-it is just my company name. ) ... View more

You should be able to setup a regex for this. I am no specialist in this area, but I am certain that you could filter out a part of the pathname (e.g. the year, or the month, or both) and use it for whatever you would like. ... View more

Would is not be an option to save to original to a secondary (archive) location and then replace it with your customized version? If something goes wrong with you version, you could simply copy the original back from the archive, restart the services and it should be back up and running again... ... View more

You could setup a Windows failover cluster specific for this role and define the Splunk process as a custom service. It will then failover when your primairy node or a dependency (Network/Disk) fails. ... View more