Deployment Architecture

Migrate splunkforwarder on to a new server

geopc
New Member

We have a jetty server "geoappserver" with IP 192.168.0.1 and in that its already running splunkforwarder and was working fine. We are using this hostname and in splunk this server is listing ans log files are able to search.

Its a opensuse server. Now we are moving this server to a Oracle Linux server and we moved jetty server in which all logs files are on same location.

We moved splunkforwarder to new Oracle linux server and bring down opensuse server.

Started splunk service and is running but when we search in splunk server its listing old data only and from new server logs are displaying.

06-20-2018 05:53:43.167 -0700 ERROR TailReader - File will not be read, seekptr checksum did not match (file=/opt/jetty/logs/jetty-services.log).  Last time we saw this initcrc, filename was different.  You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source.  Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.
06-20-2018 05:53:43.169 -0700 INFO  WatchedFile - File too small to check seekcrc, probably truncated.  Will re-read entire file='/opt/splunkforwarder/var/log/splunk/splunkd_ui_access.log'.
06-20-2018 05:53:43.172 -0700 INFO  WatchedFile - Will begin reading at offset=287733 for file='/opt/splunkforwarder/var/log/splunk/metrics.log'.
06-20-2018 05:53:43.173 -0700 INFO  WatchedFile - File too small to check seekcrc, probably truncated.  Will re-read entire file='/opt/splunkforwarder/var/log/splunk/scheduler.log'.

We moved entire splunkforwarder to new server and started splunk again. So please let me any other chnage we need to do on this.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...