Getting Data In

How does Splunk connect to the Universal forwarders — using IP or HostNames?

arrangineni
Path Finder

Can anyone clarify if Splunk Deployment server and Indexer connects to Universal forwarder using hostname or IP address. How can we find that?

0 Karma
1 Solution

sbattista09
Contributor

the UF will reach out to the deployment server with deploymentclient.conf
https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Deploymentclientconf

[deployment-client]
phoneHomeIntervalInSecs = 500
[target-broker:deploymentServer]
# Change the targetUri
targetUri = here it can be IP OR FQDN over what ever port you have set the default it 8089 i think.

The UF will send logs to indexers with outputs.conf
https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Outputsconf

[tcpout]
defaultGroup = splunkgroup

[tcpout:splunkgroup]
server= here it can be IP OR FQDN over what ever port you have set the default is 9997 indexer1.example.com:9997, indexer2.example.com:99978, indexer3.example.com:9997
autoLB = true
autoLBFrequency = 7
forceTimebasedAutoLB = true

View solution in original post

sbattista09
Contributor

the UF will reach out to the deployment server with deploymentclient.conf
https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Deploymentclientconf

[deployment-client]
phoneHomeIntervalInSecs = 500
[target-broker:deploymentServer]
# Change the targetUri
targetUri = here it can be IP OR FQDN over what ever port you have set the default it 8089 i think.

The UF will send logs to indexers with outputs.conf
https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Outputsconf

[tcpout]
defaultGroup = splunkgroup

[tcpout:splunkgroup]
server= here it can be IP OR FQDN over what ever port you have set the default is 9997 indexer1.example.com:9997, indexer2.example.com:99978, indexer3.example.com:9997
autoLB = true
autoLBFrequency = 7
forceTimebasedAutoLB = true

arrangineni
Path Finder

Thanks for the clarification.

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more!  Faster Time to Value Managing and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...