Deployment Architecture

Splunk deployment - multiple A records issue

adnalla
New Member

We have setup deployment server. It works pretty well but we have problem with one of our systems - We have four machines (windows) where splunk universal forwarders are installed and these four machines are part of a distributed system setup. We have multiple A records for the same domain name. i.e These servers are hit on a round robin basis for load balancing purposes.

I understand the deployment server uses reverse DNS lookup to identify the hostname. ON reverse lookup of each IP of the above machines, you get two records - one is the domain name we have setup for load balancing and the other is the complete hostname(FQDN)

Whenever the deployment server captures the FQDN/hostname as the dns attribute, it is able to push the apps without any issue. But if the domain name we have set for load balancing is captured all apps are wiped off the client machines.

PLease help as we couldnt find any configuration in Splunk to handle this?

Tags (1)
0 Karma

Mathieu_Dessus
Splunk Employee
Splunk Employee

Have you tried to enter manual addresses in /etc/hosts (or widows equivalent if the deployment server runs windows) in order to force Splunk to see non-balanced addresses ?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...