Getting Data In

How to push inputs.conf changes to multiple universal forwarders in my Splunk environment without editing each individual machine?

nce054
Path Finder

I am getting to the point where I have quite a few Universal Forwarders in my Splunk infrastructure. I was wondering if there was a more simple way of installing/configuring the Universal Forwarders, specifically in inputs.conf. Every change I want to make I have to go through each machines' inputs.conf to alter it. As an infomercial might say, "There's got to be a better way!"

Any help appreciated.

0 Karma
1 Solution

JoeSco27
Communicator

You should try using a deployment server to push configuration changes to your Universal Forwarders. Try taking a look here: http://answers.splunk.com/answers/209735/which-inputsconf-do-i-edit-for-a-universal-forward.html

and here: http://docs.splunk.com/Documentation/Splunk/6.2.1/Updating/Aboutdeploymentserver

View solution in original post

JoeSco27
Communicator

You should try using a deployment server to push configuration changes to your Universal Forwarders. Try taking a look here: http://answers.splunk.com/answers/209735/which-inputsconf-do-i-edit-for-a-universal-forward.html

and here: http://docs.splunk.com/Documentation/Splunk/6.2.1/Updating/Aboutdeploymentserver

nce054
Path Finder

I have a deployment server that I am already using to push apps, I am just unaware of how to push specific input.conf settings. Do I have to make my own "app", and push it?

JoeSco27
Communicator

Yes, you would have to make your own "app" and push it out to your Universal forwarders using deployment-apps.

http://docs.splunk.com/Documentation/Splunk/6.2.3/Updating/Createdeploymentapps

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...