Cloning/Restoring Servers with Splunk Universal Forwarder

For prepping an image for cloning or staging of Splunk, please see the following Splunk provided documentation.

If you are cloning a running production machine, the process for cleaning the configuration might not work well and impact the running Splunk instance sending logs into Splunk. If you are in this situation we recommend that on the cloned machine you perform the following checks to avoid GUID conflicts on the Splunk environment.

1. To generate a new Splunk agent GUID on the cloned machine
   SPLUNK_DIR/bin/splunk stop
   mv SPLUNK_DIR/etc/instance.cfg SPLUNK_DIR/etc/instance.old
   SPLUNK_DIR/bin/splunk start

2. Verify that the following files do not reflect the previous machine’s name.
   1. SPLUNK_DIR/etc/system/local/server.conf
   2. SPLUNK_DIR/etc/system/local/deploymentclient.conf
   3. SPLUNK_DIR//etc/system/local/inputs.conf
3. Contact splunk-support@illinois.edu to notify that a new machine needs to be added to the Deployment Server.