topic Re: Update Universal Forwarder in Deployment Architecture

Update Universal Forwarder

edgarsilva01 — Wed, 10 Jun 2020 18:07:36 GMT

How can I update 300 forwarders quickly?
Is there any method?

Re: Update Universal Forwarder

gcusello — Wed, 12 Feb 2020 17:41:12 GMT

Hi @edgarsilva01,
What't the operative system of your servers?
Linux UFs are easy to upgrade using a remote script shell that you can find in Community (if not I can send you!).
For Windows UFs, you have to use a SW distribution tool.

Ciao.
Giuseppe

Re: Update Universal Forwarder

edgarsilva01 — Wed, 12 Feb 2020 17:45:18 GMT

Hi Giuseppe

Linux...

If you could share the script I would be very helpful 🙂

Thanks

Re: Update Universal Forwarder

gcusello — Wed, 12 Feb 2020 18:01:48 GMT

Hi @edgarsilva01,
see this (even if it's non accepted!) https://answers.splunk.com/answers/786947/install-splunk-forwarder-in-linux-servers.html
Ciao.
Giuseppe

Re: Update Universal Forwarder

manuelostertag — Wed, 10 Jun 2020 15:46:46 GMT

Hi @gcusello,

I have to update a lot of Windows UF and try the new app in the splunk base (https://splunkbase.splunk.com/app/5003); this app distribute the installation itself from the Deployment Server to the UF and run the installation.

I did not get the installation to run, it seems the SplunkForwarder Service cannot perform an installation. If I run the scripts manually, it works.

Did you know if an installation via the SplunkForwarder Service is possible?

Thanks

Manuel

Re: Update Universal Forwarder

dauren_akilbeko — Wed, 10 Jun 2020 16:02:55 GMT

I would recommend using some kind of configuration management system to do this on scale. If you those are Linux (should work on Windows too) I think Ansible is a good solution for this task.

https://underdefense.com/effortless-splunk-universal-forwarders-update-with-ansible/

Re: Update Universal Forwarder

manuelostertag — Wed, 10 Jun 2020 16:09:18 GMT

Thanks for the fast response, I will check if his is a solution for us.

Manuel