topic Conf File Variables in Deployment Architecture

Conf File Variables

jdmeek — Wed, 14 Jan 2026 20:48:23 GMT

I'm reverse engineering UF configs from an old deploy server that we're replacing and am running into variables in conf files but I'm not finding where the values are defined.

An example would be an if_ip in an outputs.conf entry...

[tcpout:primary_forwarders]
server = {{ hf_ip }}:9997

They look like custom variables as they would be used in Observability Cloud but this is in a standard Enterprise deploy.

Re: Conf File Variables

livehybrid — Wed, 14 Jan 2026 21:50:47 GMT

Hi @jdmeek

The syntax looks like its something like a Jinja2 template for an ansible deployed config, could this be the case here?

The following is an example of what a correct outputs.conf could look like:

[tcpout:primary_forwarders] server = 10.0.14.129:9997 or [tcpout:primary_forwarders] server = splunkrcv.mycompany.com:9997,myotherhost.mycompany.com:9997

For more information on outputs.conf check out https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/9.4/configuration-file-reference/9.4.1-configuration-file-reference/outputs.conf

If you are seeing variables named if_ip as well as hf_ip then it would suggest you also have intermediate forwarders.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Conf File Variables

jdmeek — Wed, 14 Jan 2026 22:34:52 GMT

After backing away for a bit, I'm guessing that this is supposed to serve as a template and should be commented out.