topic Re: Is there a way to clear down the config of an installed UF and then point it to the distribution server for new conf in Installation

Is there a way to clear down the config of an installed UF and then point it to the distribution server for new configs?

anapp — Wed, 26 Apr 2023 17:20:25 GMT

Hi All

I need a way to clear down the config of an installed UF and then point it to the distribution server and pick up new/refreshed configs

Apart from uninstalling, removing files and re-installing the UF is there a clever way of doing this

(background, we've a number of hosts reporting in as the wrong hostname, and want to sort them out)

Cheers

Re: Is there a way to clear down the config of an installed UF and then point it to the distribution server for new conf

VatsalJagani — Wed, 26 Apr 2023 18:34:37 GMT

@anapp - Write a shell script for Linux/Unix devices and CMD/PowerShell scripts for Windows devices.

Create a custom App on current deployment server.
Write this script as Splunk scripted input.
What does this script do:
- Update the configuration file to point to the new deployment server.
- Splunk Restart.
  - Because your script is running as a child process of Splunk it cannot restart Splunk successfully.
  - So you need to run it under the wrapper script. Here is an example to start with:

#!/bin/bash SCRIPT=`/usr/bin/realpath $0` SCRIPTPATH=`/usr/bin/dirname $SCRIPT` echo "Executing $SCRIPTPATH/my_script.sh $SPLUNK_HOME" >&2 (exec /usr/bin/setsid /usr/bin/sh $SCRIPTPATH/my_script.sh $SPLUNK_HOME &)

And then use wrapper script as Scripted input.
Make sure to keep the new configuration ready on the new deployment server beforehand.

Kindly upvote if this helps!!!

Re: Is there a way to clear down the config of an installed UF and then point it to the distribution server for new conf

anapp — Thu, 27 Apr 2023 16:17:36 GMT

thanks - useful but not quite what I need, I should have been more specific 🙂

We seem to have some servers built from a template whereby they are "reporting in" as the wrong servername. I assumed I could correct the local\server.conf to correct this but that doesn't seem to fix the issue.

So I'm looking for as general as possible "wipe" of local config so it only knows the deployment server and starts afresh

Re: Is there a way to clear down the config of an installed UF and then point it to the distribution server for new conf

richgalloway — Thu, 27 Apr 2023 16:52:26 GMT

When you created the template did you run splunk clone-prep-clear-config first? That command removes the unique identifiers for the UF so it can be replicated to multiple target systems. See https://docs.splunk.com/Documentation/Splunk/9.0.4/Admin/Integrateauniversalforwarderontoasystemimage

Re: Is there a way to clear down the config of an installed UF and then point it to the distribution server for new conf

anapp — Thu, 27 Apr 2023 16:54:47 GMT

let's just say the team responsible do that _now_ 🙂