Deployment Architecture

Changing address of indexers for universal forwarders altogether



I want to know how we can change address of indexers for universal forwarders from deployment server as we have many UFs. Is there any way to change inputs.conf  of UFs instead of changing one by one.



Labels (3)
Tags (1)
0 Karma


If I understand right you want to change UF's target server addresses on outputs.confs?

You should just create/update your UFs' app where you have all needed information to connect to your splunk indexers? I suppose that you have this kind of app in use instead of hard coded those under .../system/local/outputs.conf? If you haven't it then you should create one and migrate all your UFs to use it.

If you have indexer cluster in use then you you should use indexer discovery to manage these connections automatically.

r. Ismo

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!