https://community.splunk.com/t5/Deployment-Architecture/Replacing-an-indexer-in-forwarder-s-outputs-conf-using-a/m-p/543245#M18626 <P>If the outputs.conf file is part of an app and NOT in $SPLUNK_HOME/etc/system/local then, yes, the DS can update that app with a new outputs.conf that is missing the removed indexer.</P><P>If the forwarder's outputs.conf file IS in etc/system/local then all is not lost.&nbsp; The DS can push the same app as above, but must also deliver a scripted input that deletes $SPLUNK_HOME/etc/system/local/outputs.conf.&nbsp; Make sure the settings in the deleted outputs.conf file are replaced by settings in outputs.conf files delivered in one or more apps.</P> Wed, 10 Mar 2021 19:51:04 GMT richgalloway 2021-03-10T19:51:04Z https://community.splunk.com/t5/Deployment-Architecture/Replacing-an-indexer-in-forwarder-s-outputs-conf-using-a/m-p/543242#M18625 <P>Can I remove an indexer from deployed forwarders' outputs.conf using the deployment server?</P> Wed, 10 Mar 2021 18:51:33 GMT https://community.splunk.com/t5/Deployment-Architecture/Replacing-an-indexer-in-forwarder-s-outputs-conf-using-a/m-p/543242#M18625 frednuffer 2021-03-10T18:51:33Z https://community.splunk.com/t5/Deployment-Architecture/Replacing-an-indexer-in-forwarder-s-outputs-conf-using-a/m-p/543245#M18626 <P>If the outputs.conf file is part of an app and NOT in $SPLUNK_HOME/etc/system/local then, yes, the DS can update that app with a new outputs.conf that is missing the removed indexer.</P><P>If the forwarder's outputs.conf file IS in etc/system/local then all is not lost.&nbsp; The DS can push the same app as above, but must also deliver a scripted input that deletes $SPLUNK_HOME/etc/system/local/outputs.conf.&nbsp; Make sure the settings in the deleted outputs.conf file are replaced by settings in outputs.conf files delivered in one or more apps.</P> Wed, 10 Mar 2021 19:51:04 GMT https://community.splunk.com/t5/Deployment-Architecture/Replacing-an-indexer-in-forwarder-s-outputs-conf-using-a/m-p/543245#M18626 richgalloway 2021-03-10T19:51:04Z https://community.splunk.com/t5/Deployment-Architecture/Replacing-an-indexer-in-forwarder-s-outputs-conf-using-a/m-p/543246#M18627 <P>When/if you are using separate TA for those config it’s easy task. Just update outputs.conf in DS and in next round it has changed. If you have output.conf under system/local it is also doable with some tricks. You should found instructions by googling. But anyhow I strongly propose that you should always use a separate app/TA for these configurations.</P><P>r. Ismo</P> Wed, 10 Mar 2021 19:51:41 GMT https://community.splunk.com/t5/Deployment-Architecture/Replacing-an-indexer-in-forwarder-s-outputs-conf-using-a/m-p/543246#M18627 isoutamo 2021-03-10T19:51:41Z