Deployment Architecture

How to change Deployment Client Instance ID?

guarisma
Contributor

I have a couple of heavy Forwarders that we've been using for a while without a deployment server, now we want to use a DS to manage their Apps and make sure they are consistent, but it seems the original installation was a clone or a copy of the splunk folder so both instances have the same GUID (Instance ID)

The Deployment Server is noticing this:

WARN ClientSessionsManager - Client with Id 'F8857965-300D-4E42-AECA-D35597DC4441' has changed some of its properties on the latest phone home.Old properties are: {ip=38.X.X.X, dns=FQDN, hostname=XXXCHSLKHF01, deploymentClientName="XXXCHSLKHF01", connectionId=connection_38.x.x.x.x_8089_38X.X.X_XXXCHSLKHF01_XXXCHSLKHF01, utsname="linux-x86_64", build=7af3758d0d5e, mgmt=8089, splunkVersion=7.3.3, package=enterprise, instanceId=F8857965-300D-4E42-AECA-D35597DC4441, instanceName=XXXCHSLKHF01}. New properties are: {ip=38.X.X.X, dns=38.130.118.2, hostname=XXXMNSLKHF01, deploymentClientName="F8857965-300D-4E42-AECA-D35597DC4441", connectionId=connection_38.X.X.X_8089_38.X.X.X_XXXMNSLKHF01_F8857965-300D-4E42-AECA-D35597DC4441, utsname="linux-x86_64", build=7af3758d0d5e, mgmt=8089, splunkVersion=7.3.3, package=enterprise, instanceId=F8857965-300D-4E42-AECA-D35597DC4441, instanceName=XXXMNSHF}.

So the DS will replace one HF with the other every time one calls back.

How can I change this Instance ID?

Labels (2)
Tags (1)
0 Karma
1 Solution

thambisetty
Super Champion

I follow below steps after vm is cloned:

sudo -u splunkuser $SPLUNK_HOME/bin/splunk set  servername $HOSTNAME
sudo -u splunkuser $SPLUNK_HOME/bin/splunk set  default-hostname $HOSTNAME
sudo -u splunkuser rm -rf $SPLUNK_HOME/etc/instance.cfg
sudo -u splunkuser $SPLUNK_HOME/bin/splunk restart
————————————
If this helps, give a like below.

View solution in original post

thambisetty
Super Champion

I follow below steps after vm is cloned:

sudo -u splunkuser $SPLUNK_HOME/bin/splunk set  servername $HOSTNAME
sudo -u splunkuser $SPLUNK_HOME/bin/splunk set  default-hostname $HOSTNAME
sudo -u splunkuser rm -rf $SPLUNK_HOME/etc/instance.cfg
sudo -u splunkuser $SPLUNK_HOME/bin/splunk restart
————————————
If this helps, give a like below.

View solution in original post

guarisma
Contributor

Thanks!

I just needed this line in my case since someone else change the rest manually

sudo -u splunkuser rm -rf $SPLUNK_HOME/etc/instance.cfg

 

0 Karma

soutamo
SplunkTrust
SplunkTrust
Please try to avoid -r on rm unless your really want to remove files recursively!
0 Karma

guarisma
Contributor

Thanks, this is great material, I'm forwarding this information to my client

0 Karma

vikramyadav
Contributor

It doesn't mean anything, but definitely you can just delete it and it will be re-generated.

-------------------------------

If this help your like would be appreciated 🙂

guarisma
Contributor

Right, but I didn't know where to find it to change it or delete it, now I know it's in

sudo -u splunkuser rm -rf $SPLUNK_HOME/etc/instance.cfg
0 Karma

soutamo
SplunkTrust
SplunkTrust
Hi
I haven’t try to change this on live instance, but you could try to change GUID on instance.cfg file. https://docs.splunk.com/Documentation/Splunk/7.3.3/Admin/Instancecfgconf
r. Ismo
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.