topic Re: Is there an easy way to redirect existing universal forwarders to a new Splunk deployment? in Getting Data In

Is there an easy way to redirect existing universal forwarders to a new Splunk deployment?

phillipmadm — Fri, 15 Sep 2017 19:43:12 GMT

We are migrating datacenters and the current virtual deployment server has been replicated to the new facility. I can bring it up, change the IP and hostname but is there a central way to redirect existing universal forwards to the newly IP'ed deployment server? Most suggestions I've seen online are outdated and end up saying do it manually anyway.

Re: Is there an easy way to redirect existing universal forwarders to a new Splunk deployment?

rphillips_splk — Fri, 15 Sep 2017 20:55:43 GMT

If you are managing the forwarders with a deployment server you could update outputs.conf via an app to change the indexers you are forwarding to.

https://docs.splunk.com/Documentation/MSApp/1.4.2/MSInfra/Setupadeploymentserver

Re: Is there an easy way to redirect existing universal forwarders to a new Splunk deployment?

gcusello — Sat, 16 Sep 2017 06:49:07 GMT

Hi phillipmadm,
the easiest way is to run a remote script or use a software distribution system.
I read that it's possible to use the old Deployment Server But I didn't tryed because deploymentclient.conf is usually located in %SPLUNK_HOME/system/local and a script it's easier.
Bye.
Giuseppe

Re: Is there an easy way to redirect existing universal forwarders to a new Splunk deployment?

ddrillic — Sat, 16 Sep 2017 11:32:44 GMT

Absolutely - this is quite a big challenge to update all the deploymentclient.conf on all the forwarders. A remote script which iterates through all the forwarders is what we do. Now, if some of the forwarders are on Windows and some on Linux, AIX, Solaris, the script needs to be pretty evolved...

Re: Is there an easy way to redirect existing universal forwarders to a new Splunk deployment?

gcusello — Sat, 16 Sep 2017 16:24:13 GMT

Yes it needs!
infact we used two different scripts for Linux and AIX (only just a little different, in connection!), but it's a very simple script because you have to perform only three actions:

connect to the remote server,
copy the new deploymentclient.conf in $SPLUNK_HOME/etc/system/local,
run $SPLUNK_HOME/bin/splunk restart

So it's very quick to create and run these three scripts.

Check if you have something like LanDesk to deploy deploymentclient.conf to Windows servers.

Bye.
Giuseppe

Re: Is there an easy way to redirect existing universal forwarders to a new Splunk deployment?

phillipmadm — Mon, 18 Sep 2017 17:12:12 GMT

Our environment is Windows, RedHat and Solaris so not the easy solution I was looking for.
:)

Re: Is there an easy way to redirect existing universal forwarders to a new Splunk deployment?

phillipmadm — Mon, 18 Sep 2017 17:19:10 GMT

We are currently using a deployment server that is replicated to a new datacenter. We can standup the replicated server with a unique address but I do not see in the referenced link where we can point existing machines to the IP. A script to update the deploymentclient.conf is valid but writing one that parses out the various operating systems in our environment is challenging with the current staffing levels. Manual seems to be the way to go.

Re: Is there an easy way to redirect existing universal forwarders to a new Splunk deployment?

gcusello — Mon, 18 Sep 2017 17:27:27 GMT

Could you use the old DS ip address on the new one?
In this way you solve your problems
Bye.
Giuseppe

Re: Is there an easy way to redirect existing universal forwarders to a new Splunk deployment?

phillipmadm — Mon, 18 Sep 2017 17:30:55 GMT

I wish but the Network guys would go nuts. New physical datacenter with a separate IP range.

Re: Is there an easy way to redirect existing universal forwarders to a new Splunk deployment?

ddrillic — Mon, 18 Sep 2017 17:56:53 GMT

@phillipmadm, look, you need this type of scripts anyway...

Re: Is there an easy way to redirect existing universal forwarders to a new Splunk deployment?

gcusello — Wed, 20 Sep 2017 11:19:17 GMT

If this answer satisfies your question, please accept or upvote it.
Bye.
Giuseppe