at the moment I am using a Deployment Server which is also the SearchHead.
Forwarders were installed automaticly and they get a deploymentclient.conf file placed to /opt/splunk/etc/system/local (highest priority).
Because of performance issues I plan to introduce a new Deployment Server. Now I am not sure how can I say to the existing Forwarders that there is a new Deployment Server to connect.
The idea was to use the global app and in that app I would define the deploymentclient.conf with the new Deployment Server. I would placed that App on the old Deployment Server and after a phonehome the Forwarder gets the new configuration and connecting to the new Deployment Server.
But there is one problem. I think the highest priority has /opt/splunk/etc/system/local and this configuration will override the configuration in the global app. So what can I do to change the Deployment Server by using the Deployment Server to change that configuration.
Thank you in advance
From what I understand you will have to have an external to Splunk method to delete the deployment.conf file in system/local. This is a known issue apparently. Its too bad it isn't put in the etc/apps folder by default.
Order of events would be that all your forwarders get an app with a new deploymentclient.conf file and then the one in system/local is deleted through some method. Otherwise you will end up with an orphaned forwarder.