https://community.splunk.com/t5/Getting-Data-In/How-does-Splunk-connect-to-the-Universal-forwarders-using-IP-or/m-p/398223#M70997 <P>the UF will reach out to the deployment server with deploymentclient.conf<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Deploymentclientconf">https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Deploymentclientconf</A></P> <PRE><CODE>[deployment-client] phoneHomeIntervalInSecs = 500 [target-broker:deploymentServer] # Change the targetUri targetUri = here it can be IP OR FQDN over what ever port you have set the default it 8089 i think. </CODE></PRE> <P>The UF will send logs to indexers with outputs.conf<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Outputsconf">https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Outputsconf</A></P> <PRE><CODE>[tcpout] defaultGroup = splunkgroup [tcpout:splunkgroup] server= here it can be IP OR FQDN over what ever port you have set the default is 9997 indexer1.example.com:9997, indexer2.example.com:99978, indexer3.example.com:9997 autoLB = true autoLBFrequency = 7 forceTimebasedAutoLB = true </CODE></PRE> Thu, 04 Apr 2019 02:15:31 GMT sbattista09 2019-04-04T02:15:31Z https://community.splunk.com/t5/Getting-Data-In/How-does-Splunk-connect-to-the-Universal-forwarders-using-IP-or/m-p/398222#M70996 <P>Can anyone clarify if Splunk Deployment server and Indexer connects to Universal forwarder using hostname or IP address. How can we find that?</P> Wed, 03 Apr 2019 21:29:44 GMT https://community.splunk.com/t5/Getting-Data-In/How-does-Splunk-connect-to-the-Universal-forwarders-using-IP-or/m-p/398222#M70996 arrangineni 2019-04-03T21:29:44Z https://community.splunk.com/t5/Getting-Data-In/How-does-Splunk-connect-to-the-Universal-forwarders-using-IP-or/m-p/398223#M70997 <P>the UF will reach out to the deployment server with deploymentclient.conf<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Deploymentclientconf">https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Deploymentclientconf</A></P> <PRE><CODE>[deployment-client] phoneHomeIntervalInSecs = 500 [target-broker:deploymentServer] # Change the targetUri targetUri = here it can be IP OR FQDN over what ever port you have set the default it 8089 i think. </CODE></PRE> <P>The UF will send logs to indexers with outputs.conf<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Outputsconf">https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Outputsconf</A></P> <PRE><CODE>[tcpout] defaultGroup = splunkgroup [tcpout:splunkgroup] server= here it can be IP OR FQDN over what ever port you have set the default is 9997 indexer1.example.com:9997, indexer2.example.com:99978, indexer3.example.com:9997 autoLB = true autoLBFrequency = 7 forceTimebasedAutoLB = true </CODE></PRE> Thu, 04 Apr 2019 02:15:31 GMT https://community.splunk.com/t5/Getting-Data-In/How-does-Splunk-connect-to-the-Universal-forwarders-using-IP-or/m-p/398223#M70997 sbattista09 2019-04-04T02:15:31Z https://community.splunk.com/t5/Getting-Data-In/How-does-Splunk-connect-to-the-Universal-forwarders-using-IP-or/m-p/398224#M70998 <P>Thanks for the clarification.</P> Thu, 04 Apr 2019 03:31:46 GMT https://community.splunk.com/t5/Getting-Data-In/How-does-Splunk-connect-to-the-Universal-forwarders-using-IP-or/m-p/398224#M70998 arrangineni 2019-04-04T03:31:46Z