Hi All,
I am planning to configure two Splunk Universal Forwarder instances on one of our AIX machines. Version of Splunk 6.1.3 & 6.3.0.
What are the places that I need to make changes in order to make the two instances run with out any issues?
I have changed the web.conf by changing the management ports.
Help in this regard is very helpful.
Regards,
bharathkumarnec did you find a resolution for this? I'm running into the same issue on AIX 7.1 while attempting to install multiple forwarders.
Works fine on Linux.
No!Dint find any!
If you are planning to manage the instances from a Deployment Server
, you need to make sure each instance EITHER uses a separate NIC (so you can say DottedQuad1 is instance1 and gets certain stuff and DottedQuad2 is instance2 and gets other stuff) OR you need to set clientName
differently between the two instances inside deploymentclient.conf
:
clientName = deploymentClient
* Defaults to deploymentClient.
* A name that the deployment server can filter on.
* Takes precedence over DNS names.
http://docs.splunk.com/Documentation/Splunk/6.3.1511/admin/Deploymentclientconf
Hi woodcock,
Below is the message that I am getting when running second instance:
0513-029 The splunkd sybsytem is already active.
Multiple instances are not supported.
I will admit, the last time that I did this was on 6.0 and it was possible. It is entirely possible that between that release and whatever you are using that Splunk has written extra code into splunkd
to disable this architectural approach. I would open a support case.
You do have to run it on a different port but that does not appear to be the problem that you are experiencing.
Thanks & yes I am running two instances on two different ports!
I don't know if there are any AIX specific issues.
On linux we just change management port and it works fine.
Hi jplumsdaine22,
Everything working fine on Linux machines in our environment, but not on AIX machine.
Message : Multiple services cannot be run
Looks like we need to change the subsystem name, not sure just a guess
Sorry to hear that. Where is that message coming from? Splunk or AIX ?
Below is the message I am getting after starting second splunk instance:
Multple instances cannot run..
Oh - Are you starting the instances in seperate locations ? For example
/opt/splunk-instance-1/bin/splunk and /opt/splunk-instance-2/bin/splunk
yes both instances are in different locations:
0513-029 The splunkd sybsytem is already active.
Multiple instances are not supported.
This is the message I am getting.
Must be something AIX specific. Have you tried splunk support?