topic Re: Changing UF outputs.conf using deployment server in Getting Data In

Changing UF outputs.conf using deployment server

clymbouris — Wed, 14 Nov 2012 16:58:03 GMT

I was wondering if I can use our deployment server to change the outputs.conf on our windows universal forwarders so they point to another indexer if needed to.. is there any standard practice for doing this?

Many thanks

Re: Changing UF outputs.conf using deployment server

dwaddle — Wed, 14 Nov 2012 17:19:20 GMT

Yes you can absolutely do this, subject to Splunk's rules for configuration file precedence. Specifically, anything you configure in $SPLUNK_HOME/etc/system/local/outputs.conf can override an outputs.conf pushed by deployment server.

Our practice for doing this is having a small app that we deploy using deployment server that has the correct outputs.conf in it. We make sure that when we install the UF we do not configure it with any local outputs.conf configuration. (In fact, we try to make sure that UF gets NO configuration except from deployment server)

Re: Changing UF outputs.conf using deployment server

yannK — Wed, 14 Nov 2012 17:19:31 GMT

usual method is to :

create an app in the deployment server in .../etc//deployment-apps//default/outputs.conf
define a serverclass.conf on the deployment server (to match clients to apps)
configure the forwarders to point to the deployment-server in deploymentclient.conf

see http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Aboutdeploymentserver

only potential hiccup, if your existing outputs.conf is already in /etc/system/local, then it will have precedence on the one in the deployed app, so move it away first.

Re: Changing UF outputs.conf using deployment server

clymbouris — Wed, 14 Nov 2012 17:53:02 GMT

that's probably what I'm looking for.. but even If the /system/local/outputs.conf and /apps/UniversalForwarder/.../output.conf aren't configured how does then /UnivesalForwarder/../output.conf picks up the indexer from the correct output.conf of your app?

Re: Changing UF outputs.conf using deployment server

dwaddle — Wed, 14 Nov 2012 18:06:00 GMT

Because outputs.conf - like most any other Splunk config file - is merged together from all of the various apps in the installation. Several different outputs.conf files are all pulled together into a "master copy" according to defined rules. You can look at how this is done by using btool. http://docs.splunk.com/Documentation/Splunk/5.0/Troubleshooting/Usebtooltotroubleshootconfigurations

Re: Changing UF outputs.conf using deployment server

clymbouris — Wed, 14 Nov 2012 18:08:28 GMT

Thanks a lot dwaddle it's clear now 🙂

Re: Changing UF outputs.conf using deployment server

luisgustavo — Thu, 23 Oct 2014 12:16:19 GMT

The path in you answer is misleading. I thought "default" was the app name, but it's a folder inside the app.
It should read:
- create an app in the deployment server in .../etc/deployment-apps/appname/default/outputs.conf

Also, 2nd step can be done in splunk web interface, in Settings > Forwarder Management

Re: Changing UF outputs.conf using deployment server

btran — Mon, 28 Sep 2020 18:46:38 GMT

the answer is misleading. you can change the $splunk_home/etc/system/local/outputs.conf file. you can only change $splunk_home/etc/apps/$app_name$/local/outputs.conf
thank you

Re: Changing UF outputs.conf using deployment server

dstuder — Wed, 30 Sep 2020 05:11:46 GMT

I believe you meant to say ...

the answer is misleading. you can't change the $splunk_home/etc/system/local/outputs.conf file. you can only change $splunk_home/etc/apps/$app_name$/local/outputs.conf
thank you