Update Universal Forwarder

[edgarsilva01]

How can I update 300 forwarders quickly?
Is there any method?

[dauren_akilbeko]

I would recommend using some kind of configuration management system to do this on scale. If you those are Linux (should work on Windows too) I think Ansible is a good solution for this task.

https://underdefense.com/effortless-splunk-universal-forwarders-update-with-ansible/

[manuelostertag]

Thanks for the fast response, I will check if his is a solution for us.

Manuel

[gcusello · Accepted solution]

Hi @edgarsilva01,
What't the operative system of your servers?
Linux UFs are easy to upgrade using a remote script shell that you can find in Community (if not I can send you!).
For Windows UFs, you have to use a SW distribution tool.

Ciao.
Giuseppe

[manuelostertag]

Hi @gcusello,

I have to update a lot of Windows UF and try the new app in the splunk base (https://splunkbase.splunk.com/app/5003);  this app distribute the installation itself from the Deployment Server to the UF and run the installation.

I did not get the installation to run, it seems the SplunkForwarder Service cannot perform an installation. If I run the scripts manually, it works.

Did you know if an installation via the SplunkForwarder Service is possible?

Thanks

Manuel

[edgarsilva01]

Hi Giuseppe

Linux...

If you could share the script I would be very helpful 🙂

Thanks

[gcusello]

Hi @edgarsilva01,
see this (even if it's non accepted!) https://answers.splunk.com/answers/786947/install-splunk-forwarder-in-linux-servers.html
Ciao.
Giuseppe