Deployment Architecture

Changing address of indexers for universal forwarders altogether



I want to know how we can change address of indexers for universal forwarders from deployment server as we have many UFs. Is there any way to change inputs.conf  of UFs instead of changing one by one.



Labels (3)
Tags (1)
0 Karma


If I understand right you want to change UF's target server addresses on outputs.confs?

You should just create/update your UFs' app where you have all needed information to connect to your splunk indexers? I suppose that you have this kind of app in use instead of hard coded those under .../system/local/outputs.conf? If you haven't it then you should create one and migrate all your UFs to use it.

If you have indexer cluster in use then you you should use indexer discovery to manage these connections automatically.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...