All Apps and Add-ons

Splunk Stream change of heavy forwarder

_daver
Engager

Hi

I am running Splunk Stream in a SplunkCloud environment. I have a heavy fowarder (say hf01) that has stream app installed and it communicates with the splunk fowardwarders where Stream TA is running and pushes the latest config.

I have changed the heavy forwarder that has stream app installed from hf01 to hf03. How can I let my UF's know that now check hf03 instead of hf01 for configurations?

0 Karma
1 Solution

nabeel652
Builder

On all of your UF's (either manually or through config manager/deployment server) change the splunk_stream_app_location to new heavy forwarder. It should look like this:

[streamfwd://streamfwd]
splunk_stream_app_location = http://hf03:8000/en-US/custom/splunk_app_stream/
stream_forwarder_id = <Your fwdr id>
disabled = false

View solution in original post

nabeel652
Builder

On all of your UF's (either manually or through config manager/deployment server) change the splunk_stream_app_location to new heavy forwarder. It should look like this:

[streamfwd://streamfwd]
splunk_stream_app_location = http://hf03:8000/en-US/custom/splunk_app_stream/
stream_forwarder_id = <Your fwdr id>
disabled = false

View solution in original post

nabeel652
Builder

BTW the location of the file would be:

[SPLUNK_HOME]/etc/apps/splunk_TA_stream/local/inputs.conf

_daver
Engager

Thanks @nabeel652
That worked!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!