Splunk add-ons that poll systems (Splunk add-on for cisco ucs)

[jason0]

Hello,

I am thinking about the splunk add-on for cisco ucs, but this might apply to add-ons in general.

it's easy to visualize installing it onto a heavy forwarder, and configure it to talk to all of my ucs managers. BUT this implies a single system that does this, and I need redundancy.

My cluster of forwarders would seem to be the answer here, but if I install the add-on onto all three heavy forwarders, will I be ingesting replicated data?  

Is the add-on or splunk smart enough to prevent this?

Thank you!

--jason

[Tom_Lundie]

Hi Jason,

Unfortunately, add-ons are typically not built with this application-layer redundancy in mind and the Splunk Add-On for Cisco UCS is no exception.

Your best bet would either be to manually build this resiliency into the TA itself, or sync the configuration between your forwarders using some kind of automation tool.