I have a couple of heavy Forwarders that we've been using for a while without a deployment server, now we want to use a DS to manage their Apps and make sure they are consistent, but it seems the original installation was a clone or a copy of the splunk folder so both instances have the same GUID (Instance ID)
The Deployment Server is noticing this:
WARN ClientSessionsManager - Client with Id 'F8857965-300D-4E42-AECA-D35597DC4441' has changed some of its properties on the latest phone home.Old properties are: {ip=38.X.X.X, dns=FQDN, hostname=XXXCHSLKHF01, deploymentClientName="XXXCHSLKHF01", connectionId=connection_38.x.x.x.x_8089_38X.X.X_XXXCHSLKHF01_XXXCHSLKHF01, utsname="linux-x86_64", build=7af3758d0d5e, mgmt=8089, splunkVersion=7.3.3, package=enterprise, instanceId=F8857965-300D-4E42-AECA-D35597DC4441, instanceName=XXXCHSLKHF01}. New properties are: {ip=38.X.X.X, dns=38.130.118.2, hostname=XXXMNSLKHF01, deploymentClientName="F8857965-300D-4E42-AECA-D35597DC4441", connectionId=connection_38.X.X.X_8089_38.X.X.X_XXXMNSLKHF01_F8857965-300D-4E42-AECA-D35597DC4441, utsname="linux-x86_64", build=7af3758d0d5e, mgmt=8089, splunkVersion=7.3.3, package=enterprise, instanceId=F8857965-300D-4E42-AECA-D35597DC4441, instanceName=XXXMNSHF}.
So the DS will replace one HF with the other every time one calls back.
How can I change this Instance ID?
I follow below steps after vm is cloned:
sudo -u splunkuser $SPLUNK_HOME/bin/splunk set servername $HOSTNAME
sudo -u splunkuser $SPLUNK_HOME/bin/splunk set default-hostname $HOSTNAME
sudo -u splunkuser rm -rf $SPLUNK_HOME/etc/instance.cfg
sudo -u splunkuser $SPLUNK_HOME/bin/splunk restart
I follow below steps after vm is cloned:
sudo -u splunkuser $SPLUNK_HOME/bin/splunk set servername $HOSTNAME
sudo -u splunkuser $SPLUNK_HOME/bin/splunk set default-hostname $HOSTNAME
sudo -u splunkuser rm -rf $SPLUNK_HOME/etc/instance.cfg
sudo -u splunkuser $SPLUNK_HOME/bin/splunk restart
Thanks!
I just needed this line in my case since someone else change the rest manually
sudo -u splunkuser rm -rf $SPLUNK_HOME/etc/instance.cfg
Is this valid for Splunk 9.0 and linux?
Yes.
Thanks, this is great material, I'm forwarding this information to my client
It doesn't mean anything, but definitely you can just delete it and it will be re-generated.
-------------------------------
If this help your like would be appreciated 🙂
Right, but I didn't know where to find it to change it or delete it, now I know it's in
sudo -u splunkuser rm -rf $SPLUNK_HOME/etc/instance.cfg