Deployment Architecture

Changing Indexer IP in Univerisal Forwader

Path Finder

Hi All,

I need help , We have installed universal forwarder in around 20 machines and provided the deployment , Indexder IP . Logs are forwarder to the test server . Now we want to change the test indexer IP to Production IP
Kindly guide us when we create the Custom app for windows , Where we can define the indexer IP . So that we can push the same app in the all servers , Route the traffic to the production .

Thanks in Advance

Tags (1)
0 Karma



You need to change "server" parameter in outputs.conf (on universal forwarder) to point to Production indexer, to locate the file run the following command:

grep -R "server" /opt/splunkforwarder/etc/* | grep outputs.conf | grep -v outputs.conf.example | grep -v outputs.conf.spec | grep -v README

Then you should find the outputs.conf file that contains test server IP, change it to production server IP and restart splunk service


0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...