I have Splunk Universal Forwarder installed on RHEL. I have hundreds of stanzas manually written in $SPLUNKHOME/etc/apps//default/ to facilitate log data on-boarding from sources on the network (our Splunk PS configured it this way initially). Can this process be automated so that when new systems are introduced on the network they can be detected, and a new stanza be written/current stanza be updated manually?
