About mehmettecer

mehmettecer · ‎12-06-2011

Thanks for the link. I already saw this one. I need to install my 2nd search head.

mehmettecer · ‎12-06-2011

Hi guys, I have a distributed splunk environment where I have 1 search head and 3 indexers. I would like to install second search head for maintenance reasons, so when I need to do kernel or splunk updates on first search head, second search head is still available for users. How can I accomplish this. ? Any links to an how to would be great too. Thanks

mehmettecer · ‎10-04-2011

Hi guys, Here is my issue: I have 2 rsyslog servers that are in production in redundant setup. Other servers forward same logs to these servers at the same time. Due to UDP drops, log files are slightly different on both servers. I have Forwarder setup on only one of them, lets call it Server A, now I need to retire Server A and replace it with Server B. My question here is, when Server B comes up, will Splunk start indexing all the log files as if it was a new server ? If yes, how can I avoid duplicate indexed data in ? Is there are Splunk best practice for such situation ? I know splunk forwarder remembers where it is was left while monitoring files, is there a way to transfer that monitoring offset data to the new server so once Server B comes up it starts monitoring from where it left off ? Thanks

mehmettecer · ‎03-22-2011

Hi Ayn, I already saw that answer and tried proposed solution but I still don't see my log files indexed under custom index I created.

mehmettecer · ‎03-22-2011

Both of my servers are Linux OS and I am using latest Splunk 4.2. I can forward from UF to Splunk to index, but everything - all monitor stanzas - is going to main index. I am trying to configure UF so /var/log/case1 monitor indexed under test_case1 index, already created on Splunk server and /var/log/case2 monitor indexed under test_case2 index, also already created on Splunk server But when I try to execute following commands on splunkforwarder I get error splunk add monitor /var/log/case1 -index test_case1 splunk add monitor /var/log/case2 -index test_case2 Error is In handler 'monitor': Parameter index: Index 'test_case1' does not exist. Please provide a valid index. I searched through Answers and Documentation but I cannot seem to put together a solution for this. Any help is greatly appreciated.

Posts	5
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎03-22-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

How to install multiple search heads

Splunk Forwarder migration

How to use custom index for Universal Forwarder

Re: How to install multiple search heads

How to install multiple search heads

Splunk Forwarder migration

Re: How to use custom index for Universal Forwarde...

How to use custom index for Universal Forwarder