Deployment Architecture

Changing address of indexers for universal forwarders altogether

sh_tavousi
Explorer

Hi,

I want to know how we can change address of indexers for universal forwarders from deployment server as we have many UFs. Is there any way to change inputs.conf  of UFs instead of changing one by one.

Thanks,

Shohre

Labels (3)
Tags (1)
0 Karma

soutamo
SplunkTrust
SplunkTrust

If I understand right you want to change UF's target server addresses on outputs.confs?

You should just create/update your UFs' app where you have all needed information to connect to your splunk indexers? I suppose that you have this kind of app in use instead of hard coded those under .../system/local/outputs.conf? If you haven't it then you should create one and migrate all your UFs to use it.

If you have indexer cluster in use then you you should use indexer discovery to manage these connections automatically.

r. Ismo

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.