Deployment Architecture

How to change Deployment Client Instance ID?

guarisma
Contributor

I have a couple of heavy Forwarders that we've been using for a while without a deployment server, now we want to use a DS to manage their Apps and make sure they are consistent, but it seems the original installation was a clone or a copy of the splunk folder so both instances have the same GUID (Instance ID)

The Deployment Server is noticing this:

WARN ClientSessionsManager - Client with Id 'F8857965-300D-4E42-AECA-D35597DC4441' has changed some of its properties on the latest phone home.Old properties are: {ip=38.X.X.X, dns=FQDN, hostname=XXXCHSLKHF01, deploymentClientName="XXXCHSLKHF01", connectionId=connection_38.x.x.x.x_8089_38X.X.X_XXXCHSLKHF01_XXXCHSLKHF01, utsname="linux-x86_64", build=7af3758d0d5e, mgmt=8089, splunkVersion=7.3.3, package=enterprise, instanceId=F8857965-300D-4E42-AECA-D35597DC4441, instanceName=XXXCHSLKHF01}. New properties are: {ip=38.X.X.X, dns=38.130.118.2, hostname=XXXMNSLKHF01, deploymentClientName="F8857965-300D-4E42-AECA-D35597DC4441", connectionId=connection_38.X.X.X_8089_38.X.X.X_XXXMNSLKHF01_F8857965-300D-4E42-AECA-D35597DC4441, utsname="linux-x86_64", build=7af3758d0d5e, mgmt=8089, splunkVersion=7.3.3, package=enterprise, instanceId=F8857965-300D-4E42-AECA-D35597DC4441, instanceName=XXXMNSHF}.

So the DS will replace one HF with the other every time one calls back.

How can I change this Instance ID?

Labels (2)
Tags (1)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

I follow below steps after vm is cloned:

sudo -u splunkuser $SPLUNK_HOME/bin/splunk set  servername $HOSTNAME
sudo -u splunkuser $SPLUNK_HOME/bin/splunk set  default-hostname $HOSTNAME
sudo -u splunkuser rm -rf $SPLUNK_HOME/etc/instance.cfg
sudo -u splunkuser $SPLUNK_HOME/bin/splunk restart
————————————
If this helps, give a like below.

View solution in original post

thambisetty
SplunkTrust
SplunkTrust

I follow below steps after vm is cloned:

sudo -u splunkuser $SPLUNK_HOME/bin/splunk set  servername $HOSTNAME
sudo -u splunkuser $SPLUNK_HOME/bin/splunk set  default-hostname $HOSTNAME
sudo -u splunkuser rm -rf $SPLUNK_HOME/etc/instance.cfg
sudo -u splunkuser $SPLUNK_HOME/bin/splunk restart
————————————
If this helps, give a like below.

guarisma
Contributor

Thanks!

I just needed this line in my case since someone else change the rest manually

sudo -u splunkuser rm -rf $SPLUNK_HOME/etc/instance.cfg

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Please try to avoid -r on rm unless your really want to remove files recursively!
0 Karma

Zzo911
Engager

Is this valid for Splunk 9.0 and linux?

0 Karma

thambisetty
SplunkTrust
SplunkTrust

Yes.

————————————
If this helps, give a like below.

guarisma
Contributor

Thanks, this is great material, I'm forwarding this information to my client

0 Karma

vikramyadav
Contributor

It doesn't mean anything, but definitely you can just delete it and it will be re-generated.

-------------------------------

If this help your like would be appreciated 🙂

guarisma
Contributor

Right, but I didn't know where to find it to change it or delete it, now I know it's in

sudo -u splunkuser rm -rf $SPLUNK_HOME/etc/instance.cfg
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi
I haven’t try to change this on live instance, but you could try to change GUID on instance.cfg file. https://docs.splunk.com/Documentation/Splunk/7.3.3/Admin/Instancecfgconf
r. Ismo
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...