Change source server hostname

[Tsopergabriel]

Hello,

There is an index named "linux" in our environment that needs to have the source universal forwarder changed to reflect a new server that is forwarding data.

In other words, a server "syslog_01.server.net" was migrated to a new server "syslog_02.server.net". (not the actual domains.) The index "linux", I believe, is still listening to syslog_01, and needs to be changed to syslog_02. The universal forwarder was installed on the syslog_02 server.

So I have two fairly high-level questions:

1.) How would I go about see the current configuration of the "linux" index (at least in terms of where it is listening?)

2.) How would I change where this index is listening?

I've inherited the Splunk environment and am still a little fuzzy on how it was originally configured (the person who set it up no longer works here), but it looks like the data path goes like this:

Universal forwarder  > heavy forwarder server > two index servers < master server to control index servers. I believe this is a standard configuration.

The person who set up the environment left scant documentation regarding universal forwarder configuration. Apparently, universal forwarders are "Configured automatically by adding new universal forwarder server to linux_outputs or windows_outputs class" in the master server. However in the master server (splunk_home/etc/system/local), serverclass.conf doesn't contain any data. Although, I'm not entirely sure this would be the correct config file to change.

Again, I'm fairly new to this environment and not sure how to proceed. Any and all input would be appreciated.

Thank you!

[PickleRick]

There is no such thing as "index listening". It's forwarder's job to collect data, prepare it properly (most importantly add proper metadata like source, sourcetype, host and destination index) and send it to the destination indexer or intermediate forwarder.

So you don't have to change anything on the index side itself. Index is just a "bag" receiving events flowing from your forwarders. You need to find where the data comes from and check forwarder's configuration on that system.

If this particular piece of configuration is being pushed from the deployment server in a pre-set state, that might be a bit more complicated. But the question which can affect other stuff as well (like apps assigned to this server) is how the server syslog_01 was "migrated" to syslog_02. Especially concerning the splunk forwarder's config. If it was simply moved from one server to another there is a possibility that the forwarder's name might have been set to a static value in the config and has been retained after the configuration was moved so your new forwarder will still report to your DS under the old name. Messy.

[kprior201]

Hey there! It sounds like you should have a deployment server (https://docs.splunk.com/Documentation/Splunk/9.3.0/Updating/Deploymentserverarchitecture) somewhere in the mix. The server classes mentioned should be controlled there. This should be different than the index cluster master. The universal forwarders get their configurations from the deployment server. You should be able to go into the deployment server and both see the configuration for this index as well as assign it to the appropriate server (once it has a deploymentclient.conf, at least). If you can find the deployment server, happy to help further.