Move Deployment Server

[nebel]

Hi there,

at the moment I am using a Deployment Server which is also the SearchHead.
Forwarders were installed automaticly and they get a deploymentclient.conf file placed to /opt/splunk/etc/system/local (highest priority).

Because of performance issues I plan to introduce a new Deployment Server. Now I am not sure how can I say to the existing Forwarders that there is a new Deployment Server to connect.

The idea was to use the global app and in that app I would define the deploymentclient.conf with the new Deployment Server. I would placed that App on the old Deployment Server and after a phonehome the Forwarder gets the new configuration and connecting to the new Deployment Server.

But there is one problem. I think the highest priority has /opt/splunk/etc/system/local and this configuration will override the configuration in the global app. So what can I do to change the Deployment Server by using the Deployment Server to change that configuration.

Thank you in advance

Regards

[nebel · Accepted solution]

Yes I think the same.
I will realize this by an global script which is changing the deploymentclient.conf file with the new deployment server target.

[Runals]

From what I understand you will have to have an external to Splunk method to delete the deployment.conf file in system/local. This is a known issue apparently. Its too bad it isn't put in the etc/apps folder by default.

Order of events would be that all your forwarders get an app with a new deploymentclient.conf file and then the one in system/local is deleted through some method. Otherwise you will end up with an orphaned forwarder.