I am facing issue at time of changing deployment server from A to B.
e.g. At time of installation of forwarders I added deployment.conf in system/default folder to point server A. Now I am planning to change deployment server information and expecting forwarder to point to server B. For this i have create folder deployApp inside deployment-app in A and add new deploymentclient.conf file which was pointing to B. But I am seeing that forwarders are pointing to both servers.
I fired command in forwarders ./splunk cmd btool deploymentclient list which showing me B server information.
Now I am not able to understand why it still pointing to A with B server ?
As you know, there are several locations we can place configuration files. Splunk merges them at run time using a specific set of instructions based on file precedence to resolve conflicts (to determine the "winning" setting if it occurs in 2 or more files). The tool you used (btool) show the result of this merging as it exists on disk (NB: In some cases, when files on disk are changed, but Splunk has not been restarted, btool will show one thing while Splunk is using something else). The --debug flag is useful for showing from*where* the winning setting came.
./splunk cmd btool --debug deploymentclient list
It is also worth noting that files in default directories should never be edited, instead, copy the settings which are different to the local directory and modify those settings (they will "win" over default, per configuration file precedence.
Since deploymentclient is applied at the global context, this should be the order of operations for resolving conflicts.
1. System local directory -- highest priority 2. App local directories 3. App default directories 4. System default directory -- lowest priority
If you have everything in order per the above, and btool confirms that, you may just need to restart?
Showing B server information.
C:\Program Files\SplunkUniversalForwarder\etc\apps\deploymentApp\local\deploymentclient.conf [deployment-client]
C:\Program Files\SplunkUniversalForwarder\etc\apps\deploymentApp\local\deploymentclient.conf clientName = Forwarder-local
C:\Program Files\SplunkUniversalForwarder\etc\apps\deploymentApp\local\deploymentclient.conf [target-broker:deploymentServer]
C:\Program Files\SplunkUniversalForwarder\etc\apps\deploymentApp\local\deploymentclient.conf targetUri = adcvdiodnw7012:8091
If deploymentclient.conf is in $SPLUNK_HOME/etc/system/local/, that will trump any settings in $SPLUNK_HOME/etc/apps/deployment_client_app/
A Splunk instance cannot talk to two deployment servers at once. Allegedly.
I want to change deploymentclient.conf file from deployment server by overriding default conf file with app conf file. which is not happening and its talking with both servers old and new one.
Thanks for the command.
But i am overriding system/default/deploymentclient.conf with app/local/deploymentclient.conf. But still it taking default Deployment server A.
Why that so ?