Getting Data In

Multiple forwarders on single WS don't work in v5?

msarro
Builder

Hey everyone, I am running into some issues right now. I have a dedicated forwarding machine which has 5 instances of the universal forwarder (our tech support rep from splunk stated that the individual forwarders are limited on their throughput, and to handle the amount of data we would have to split it out to several different processes). This was set up in v4 using the method shown here: http://wiki.splunk.com/Community:Run_multiple_Splunks_on_one_machine

I backed up everything in the /opt directory, removed everything in that directory, and installed the new RPM. I created additional 4 copies in the opt directory (/opt/splunkforwarder, /opt/splunkforwarder2.../opt/splunkforwarder5). I copied back in the custom configurations (everything in /opt/splunkforwarder*N*/etc/system/local) to each instance's ~/etc/system/local directory. I also re-installed and reconfigured the startup scripts in /etc/init.d so that there are definitions for splunk through splunk5, each pointing towards a different instance of splunk, and each creating a separate lockfile. With version 4, this had been enough for it to work.

I can open the first instance (/opt/splunkforwarder) but when I try opening /opt/splunkforwarder2 through 5 it tells me that it is already running (using both the direct command path:/opt/splunkforwarder*N*/bin/splunk start, and also when using the /etc/init.d command). When I attempt to check the log /opt/splunkforwarder*n*/var/log/splunk/splunkd.log, the server reports that the file doesn't exist for splunkforwarder2-5.

Any ideas on how to get this back up and running?

0 Karma

msarro
Builder

Correct - we have 11 indexers currently. 🙂

0 Karma

sowings
Splunk Employee
Splunk Employee

Note that the universal forwarder should be able to output approx. 12M/s. Typically, we see environments where multiple indexers are required before multiple forwarders are....

In any event, glad to hear you got it working.

0 Karma

msarro
Builder

Resolved - had to use the .tgz install vs the rpm install. Seems to be working correctly now. Thanks everyon!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...