Changing address of indexers for universal forwarders altogether

[sh_tavousi]

Hi,

I want to know how we can change address of indexers for universal forwarders from deployment server as we have many UFs. Is there any way to change inputs.conf  of UFs instead of changing one by one.

Thanks,

Shohre

[isoutamo]

If I understand right you want to change UF's target server addresses on outputs.confs?

You should just create/update your UFs' app where you have all needed information to connect to your splunk indexers? I suppose that you have this kind of app in use instead of hard coded those under .../system/local/outputs.conf? If you haven't it then you should create one and migrate all your UFs to use it.

If you have indexer cluster in use then you you should use indexer discovery to manage these connections automatically.

r. Ismo