topic Re: How to push inputs.conf changes to multiple universal forwarders in my Splunk environment without editing each individual machine? in Getting Data In

How to push inputs.conf changes to multiple universal forwarders in my Splunk environment without editing each individual machine?

nce054 — Tue, 09 Jun 2015 15:35:29 GMT

I am getting to the point where I have quite a few Universal Forwarders in my Splunk infrastructure. I was wondering if there was a more simple way of installing/configuring the Universal Forwarders, specifically in inputs.conf. Every change I want to make I have to go through each machines' inputs.conf to alter it. As an infomercial might say, "There's got to be a better way!"

Any help appreciated.

Re: How to push inputs.conf changes to multiple universal forwarders in my Splunk environment without editing each individual machine?

JoeSco27 — Tue, 09 Jun 2015 15:39:46 GMT

You should try using a deployment server to push configuration changes to your Universal Forwarders. Try taking a look here: http://answers.splunk.com/answers/209735/which-inputsconf-do-i-edit-for-a-universal-forward.html

and here: http://docs.splunk.com/Documentation/Splunk/6.2.1/Updating/Aboutdeploymentserver

Re: How to push inputs.conf changes to multiple universal forwarders in my Splunk environment without editing each individual machine?

nce054 — Tue, 09 Jun 2015 15:49:48 GMT

I have a deployment server that I am already using to push apps, I am just unaware of how to push specific input.conf settings. Do I have to make my own "app", and push it?

Re: How to push inputs.conf changes to multiple universal forwarders in my Splunk environment without editing each individual machine?

JoeSco27 — Tue, 09 Jun 2015 15:57:30 GMT

Yes, you would have to make your own "app" and push it out to your Universal forwarders using deployment-apps.

http://docs.splunk.com/Documentation/Splunk/6.2.3/Updating/Createdeploymentapps