Getting Data In

Replicate VM Splunk to second VM

kmattern
Builder

We are planning on having two instances of Splunk running in different geographical locations. The machines will be part of mirrored server farms. Can we take a snapshot of the primary Splunk implementation and mount it on the second machine? Specifically, can we rename the new host without difficulty?

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Yes you can, as long as it is a true snapshot. The host names in Splunk will be in etc/system/inputs.conf and etc/system/server.conf, plus any other places you might have configured it. Any indexed data that references the local host name will still have the same host name when replicated, and that can not be easily changed, so you might want to use a logical/virtual host name in inputs.conf to manage this.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

Yes you can, as long as it is a true snapshot. The host names in Splunk will be in etc/system/inputs.conf and etc/system/server.conf, plus any other places you might have configured it. Any indexed data that references the local host name will still have the same host name when replicated, and that can not be easily changed, so you might want to use a logical/virtual host name in inputs.conf to manage this.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...