splunk-connect-for-syslog
splunk-connect-for-syslog copied to clipboard
Migrating Disk Buffer from one SC4S instance to another
Hi Team, I had a question/scenario to pose to you:
Let's say I was able to backup the my reliable disk buffering directory for SC4S and detach it from Instance 1. Would I be able to "plug and play" said directory/disk into a second instance, which would then read the buffer and send it to the HEC destination as normal? Or is this not really possible, likely due to much of the metadata and operations going on beneath the surface?
Thanks guys and hope you have an amazing day.