Deployment Architecture

Replacing an indexer in forwarder's outputs.conf using a deployment server


Can I remove an indexer from deployed forwarders' outputs.conf using the deployment server?

Labels (1)
Tags (1)
0 Karma


When/if you are using separate TA for those config it’s easy task. Just update outputs.conf in DS and in next round it has changed. If you have output.conf under system/local it is also doable with some tricks. You should found instructions by googling. But anyhow I strongly propose that you should always use a separate app/TA for these configurations.

r. Ismo


If the outputs.conf file is part of an app and NOT in $SPLUNK_HOME/etc/system/local then, yes, the DS can update that app with a new outputs.conf that is missing the removed indexer.

If the forwarder's outputs.conf file IS in etc/system/local then all is not lost.  The DS can push the same app as above, but must also deliver a scripted input that deletes $SPLUNK_HOME/etc/system/local/outputs.conf.  Make sure the settings in the deleted outputs.conf file are replaced by settings in outputs.conf files delivered in one or more apps.

If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...