https://community.splunk.com/t5/Deployment-Architecture/Managing-Universal-Forwarders-and-Indexers-hosts/m-p/96912#M3569 <P>Probably best to use a Deployment Server to manage outputs.conf across all your indexers. Just build it as part of a deployed app.</P> <P>Lots of documentation on using a deployment server:</P> <P>[<A href="http://docs.splunk.com/Documentation/Splunk/5.0.3/Deploy/Aboutdeploymentserver%5D%5B1">http://docs.splunk.com/Documentation/Splunk/5.0.3/Deploy/Aboutdeploymentserver][1</A>]</P> Tue, 16 Jul 2013 18:53:20 GMT srioux 2013-07-16T18:53:20Z https://community.splunk.com/t5/Deployment-Architecture/Managing-Universal-Forwarders-and-Indexers-hosts/m-p/96911#M3568 <P>What is the best way to manage universal forwarders and indexers at scale?</P> <P>By this I mean, If I have 10 indexers today, I specify those on the universal forwarders configuration (outputs.conf). If I add 3 new indexers will have to update every universal forwarder in my site? </P> <P>This could be upwards to 200 machines running the universal forwarders that would need an update. I've read a few times that using a loadbalancer is not a good solution to reduce the overhead of managing the indexers list. </P> <P>What is the best way to manage the indexers list and configuration on the forwarders?</P> Tue, 16 Jul 2013 18:22:53 GMT https://community.splunk.com/t5/Deployment-Architecture/Managing-Universal-Forwarders-and-Indexers-hosts/m-p/96911#M3568 imosquera 2013-07-16T18:22:53Z https://community.splunk.com/t5/Deployment-Architecture/Managing-Universal-Forwarders-and-Indexers-hosts/m-p/96912#M3569 <P>Probably best to use a Deployment Server to manage outputs.conf across all your indexers. Just build it as part of a deployed app.</P> <P>Lots of documentation on using a deployment server:</P> <P>[<A href="http://docs.splunk.com/Documentation/Splunk/5.0.3/Deploy/Aboutdeploymentserver%5D%5B1">http://docs.splunk.com/Documentation/Splunk/5.0.3/Deploy/Aboutdeploymentserver][1</A>]</P> Tue, 16 Jul 2013 18:53:20 GMT https://community.splunk.com/t5/Deployment-Architecture/Managing-Universal-Forwarders-and-Indexers-hosts/m-p/96912#M3569 srioux 2013-07-16T18:53:20Z