topic Re: Turning on Forwarder Management in Getting Data In

Will turning on Forwarder Management cause issues with existing forwarders?

jchom — Fri, 04 Nov 2022 16:32:53 GMT

Hey everyone,

This might be a bit of a silly question, but I've not seen it answered definitively and anyone I have asked regarding this also has not been able to advise.

I am working on fixing a deployment server and re-introducing the forwarder management to a Splunk environment, a previous iteration used it but oddly not the current one. And I was wondering, if I enable Forwarder Management will that cause any issues with already existed forwarders that have some custom stanza's in their inputs.conf (so resetting to a default state or to the state present on the deployment server). Or will that only take place when going through the process of getting server classes set?

Cheers!

Re: Turning on Forwarder Management

gcusello — Fri, 04 Nov 2022 07:36:17 GMT

Hi @jchom,

when you connect a Universal Forwarder to a Deployment Server, that UF can only have the apps configured on the DS.

In other words, if there's alocally manually deployed app, it will be removed when you connect the UF to the DS.

There will be no problems on local configurations (e.g. inputs.conf in local older), but only of deployed apps, if that app wasn'r deployed it will be removed.

This means that, before reintroducing Forwarders Management, you have to plan your deployment, listing on paper (or Excel):

all the apps to deploy,
all the clients to deploy,
the ServerClasses (the correlation table between clients and apps).

Then you can start your Forwarders management.

Ciao.

Giuseppe

Re: Will turning on Forwarder Management cause issues with existing forwarders?

jchom — Tue, 08 Nov 2022 04:50:05 GMT

Ok, I thought that might be the case. Now I need to make sure that there isn't anything that will cause my ingestion to blow up too much if it gets removed or rewritten.

Thanks for the assist @gcusello

Re: Will turning on Forwarder Management cause issues with existing forwarders?

gcusello — Tue, 08 Nov 2022 07:43:01 GMT

Hi @jchom,

you're always welcome!

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉