Deployment Architecture

How to change Deployment Client Instance ID?

guarisma
Contributor

I have a couple of heavy Forwarders that we've been using for a while without a deployment server, now we want to use a DS to manage their Apps and make sure they are consistent, but it seems the original installation was a clone or a copy of the splunk folder so both instances have the same GUID (Instance ID)

The Deployment Server is noticing this:

WARN ClientSessionsManager - Client with Id 'F8857965-300D-4E42-AECA-D35597DC4441' has changed some of its properties on the latest phone home.Old properties are: {ip=38.X.X.X, dns=FQDN, hostname=XXXCHSLKHF01, deploymentClientName="XXXCHSLKHF01", connectionId=connection_38.x.x.x.x_8089_38X.X.X_XXXCHSLKHF01_XXXCHSLKHF01, utsname="linux-x86_64", build=7af3758d0d5e, mgmt=8089, splunkVersion=7.3.3, package=enterprise, instanceId=F8857965-300D-4E42-AECA-D35597DC4441, instanceName=XXXCHSLKHF01}. New properties are: {ip=38.X.X.X, dns=38.130.118.2, hostname=XXXMNSLKHF01, deploymentClientName="F8857965-300D-4E42-AECA-D35597DC4441", connectionId=connection_38.X.X.X_8089_38.X.X.X_XXXMNSLKHF01_F8857965-300D-4E42-AECA-D35597DC4441, utsname="linux-x86_64", build=7af3758d0d5e, mgmt=8089, splunkVersion=7.3.3, package=enterprise, instanceId=F8857965-300D-4E42-AECA-D35597DC4441, instanceName=XXXMNSHF}.

So the DS will replace one HF with the other every time one calls back.

How can I change this Instance ID?

Labels (2)
Tags (1)
0 Karma
1 Solution

thambisetty
Super Champion

I follow below steps after vm is cloned:

sudo -u splunkuser $SPLUNK_HOME/bin/splunk set  servername $HOSTNAME
sudo -u splunkuser $SPLUNK_HOME/bin/splunk set  default-hostname $HOSTNAME
sudo -u splunkuser rm -rf $SPLUNK_HOME/etc/instance.cfg
sudo -u splunkuser $SPLUNK_HOME/bin/splunk restart
————————————
If this helps, give a like below.

View solution in original post

thambisetty
Super Champion

I follow below steps after vm is cloned:

sudo -u splunkuser $SPLUNK_HOME/bin/splunk set  servername $HOSTNAME
sudo -u splunkuser $SPLUNK_HOME/bin/splunk set  default-hostname $HOSTNAME
sudo -u splunkuser rm -rf $SPLUNK_HOME/etc/instance.cfg
sudo -u splunkuser $SPLUNK_HOME/bin/splunk restart
————————————
If this helps, give a like below.

guarisma
Contributor

Thanks!

I just needed this line in my case since someone else change the rest manually

sudo -u splunkuser rm -rf $SPLUNK_HOME/etc/instance.cfg

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Please try to avoid -r on rm unless your really want to remove files recursively!
0 Karma

guarisma
Contributor

Thanks, this is great material, I'm forwarding this information to my client

0 Karma

vikramyadav
Contributor

It doesn't mean anything, but definitely you can just delete it and it will be re-generated.

-------------------------------

If this help your like would be appreciated 🙂

guarisma
Contributor

Right, but I didn't know where to find it to change it or delete it, now I know it's in

sudo -u splunkuser rm -rf $SPLUNK_HOME/etc/instance.cfg
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi
I haven’t try to change this on live instance, but you could try to change GUID on instance.cfg file. https://docs.splunk.com/Documentation/Splunk/7.3.3/Admin/Instancecfgconf
r. Ismo
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...