Getting Data In

After deploying universal forwarders on Citrix hosts via master image, how to prevent all UF's from reporting the same hostname?

anushareddy6767
Explorer

We have a master image controlling 10 Citrix XenApp hosts, We have deployed Splunk Universal Forwarders via master image, however, all the UF's are reporting with the same master image name. From configuration files,

$SPLUNK_HOME/etc/system/local/inputs.conf

[default]
host=<master image Name>

$SPLUNK_HOME/etc/system/local/server.conf

[general]
serverName=<master image name>

If we fix these individually on the servers, that is updated...however, after rebooting the server, it downloads the master image then it all overwrites. Please advise on how to manage this scenario? Is there any way to update hostname while starting Splunk on the server?

0 Karma

bsonposh
Communicator

The only solution I found for this was to set the UF service to manual and have a script that sets the CONF files correctly and starts the service. This has to be in the base image.

Another option is to install via GPO and use deployment server for the config.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

    Thursday, June 25, 2026  |  11AM PDT / 2PM EDT  Duration: 1 Hour (Includes live Q&A) Register to ...

Analytics Workspace deprecation

As of Splunk Cloud Platform 10.4.2604 and Splunk Enterprise 10.4, Analytics Workspace is now deprecated. ...

Splunk Developer Day Recap: Building, Publishing, and Growing on the Splunk Platform

Splunk Developer Day brought the Splunk developer community together for a practical look at what it means to ...