Getting Data In

After deploying universal forwarders on Citrix hosts via master image, how to prevent all UF's from reporting the same hostname?

We have a master image controlling 10 Citrix XenApp hosts, We have deployed Splunk Universal Forwarders via master image, however, all the UF's are reporting with the same master image name. From configuration files,

$SPLUNK_HOME/etc/system/local/inputs.conf

[default]
host=<master image Name>

$SPLUNK_HOME/etc/system/local/server.conf

[general]
serverName=<master image name>

If we fix these individually on the servers, that is updated...however, after rebooting the server, it downloads the master image then it all overwrites. Please advise on how to manage this scenario? Is there any way to update hostname while starting Splunk on the server?

0 Karma

Communicator

The only solution I found for this was to set the UF service to manual and have a script that sets the CONF files correctly and starts the service. This has to be in the base image.

Another option is to install via GPO and use deployment server for the config.

0 Karma