Deployment Architecture

How is Server Identified After clone-prep-clear-config Script is Run?

Path Finder

We are using Citrix to deploy multiple servers from a master image. We have followed the directions in the doc and it works; however, when we go and look at the cloned images' server.conf file there is no [general] stanza. The cloned images' inputs.conf file does not contain an entry for host under the [default] stanza.

I'm glad the clone-prep-clear-config script works I just want to know how the UF is reporting the host name if it is not in those .conf files.

Thank you,

0 Karma

Splunk Employee
Splunk Employee

There are several things that happen when you do a clone-prep-clear-config. But here are the main things concerning the host.

First, checking out the help section for the command from a command line yields this:

./splunk help clone-prep-clear-config

Clear a Splunk instance of instance-unique config parameters, which are normally created on initial startup (first-time run, "ftr").  Intended for use after an instance has been cloned (i.e. all its files simply copied) from another instance.


There are 3 main files that get the hostname and GUID cleared (remember, there is more than just this going on):

  • inputs.conf (the host key in the [default] stanza is cleared)
  • server.conf (the serverName key in the [general] stanza is cleared)
  • instance.cfg (the guid key in the [general] stanza is cleared)

In addition to these things, a 0-bytes file named cloneprep is created in the $SPLUNK_HOME directory.

When the Universal Forwarder starts back up (which will happen after PVS or MCS has assigned the hostname and system GUIDs), all of the information is filled into the 3 files mentioned above and the cloneprep file gets deleted.

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!