https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-how-to-make-configuration-changes-and/m-p/26799#M4457 <P>Consider using Active Directory with GPO for managed software with the MSI. Other option is to use Powershell to a remote install from a shared software location.</P> Tue, 07 May 2013 22:14:31 GMT bmacias84 2013-05-07T22:14:31Z https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-how-to-make-configuration-changes-and/m-p/26796#M4454 <P>I'm getting ready to roll out Universal Forwarder on about 200 Windows servers.<BR /> What are my options if I wanted to upgrade the Universal Forwarder software at some point in the future? How can I change what type of information these servers can report (ie, add/remove different types of event logs)</P> <P>I found documentation about deployment server, but it is extremely vague and I'm not sure this is the right tool for what I'm trying to do - "The deployment server is Splunk's tool for pushing out configurations, apps, and content updates to distributed Splunk instances. You can use it to push updates to any Splunk component: forwarder, indexer, or search head." What kind of updates? What kind of configurations? Not sure what this actually means without concrete examples of what it can do.</P> <P>Other than that, I know there are scripted batch files that can be used with the Universal Forwarder. Is there any other way of remotely configuring what information the forwarders are able to send?</P> Tue, 07 May 2013 18:57:33 GMT https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-how-to-make-configuration-changes-and/m-p/26796#M4454 Mark_Barrett 2013-05-07T18:57:33Z https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-how-to-make-configuration-changes-and/m-p/26797#M4455 <P>Essentially the deployment server can distribute apps to a Splunk instance's etc/apps directory - and so, whatever apps can do, that's what you can distribute. You cannot update the forwarder itself using the deployment server.</P> <P>I can see how this can be seen as vague in a sense, because an app can be so many different things that it's hard to give one exact definition. Generally speaking the most common thing is for them to carry configuration files - you can see all configuration files that Splunk can use in <CODE>$SPLUNK_HOME/etc/system/README</CODE>.</P> Tue, 07 May 2013 19:48:00 GMT https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-how-to-make-configuration-changes-and/m-p/26797#M4455 Ayn 2013-05-07T19:48:00Z https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-how-to-make-configuration-changes-and/m-p/26798#M4456 <P>As Ayn said, you can't use the deployment server to update the forwarder itself. You'll have to use some other deployment tool for that; see the topic about <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/UpgradetheWindowsuniversalforwarder#Perform_a_remote_upgrade">performing a remote upgrade of forwarders</A> in the Distributed Deployment Manual for information about the command-line options.</P> <P>You <EM>can</EM> use the deployment server to update your forwarder configuration. There is <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Extendedexampledeployseveralstandardforwarders">an extended example</A> in the Distributed Deployment Manual.</P> Tue, 07 May 2013 21:47:38 GMT https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-how-to-make-configuration-changes-and/m-p/26798#M4456 ChrisG 2013-05-07T21:47:38Z https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-how-to-make-configuration-changes-and/m-p/26799#M4457 <P>Consider using Active Directory with GPO for managed software with the MSI. Other option is to use Powershell to a remote install from a shared software location.</P> Tue, 07 May 2013 22:14:31 GMT https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-how-to-make-configuration-changes-and/m-p/26799#M4457 bmacias84 2013-05-07T22:14:31Z