How to push inputs.conf changes to multiple universal forwarders in my Splunk environment without editing each individual machine?

[nce054]

I am getting to the point where I have quite a few Universal Forwarders in my Splunk infrastructure. I was wondering if there was a more simple way of installing/configuring the Universal Forwarders, specifically in inputs.conf. Every change I want to make I have to go through each machines' inputs.conf to alter it. As an infomercial might say, "There's got to be a better way!"

Any help appreciated.

[JoeSco27 · Accepted solution]

You should try using a deployment server to push configuration changes to your Universal Forwarders. Try taking a look here: http://answers.splunk.com/answers/209735/which-inputsconf-do-i-edit-for-a-universal-forward.html

and here: http://docs.splunk.com/Documentation/Splunk/6.2.1/Updating/Aboutdeploymentserver

[nce054]

I have a deployment server that I am already using to push apps, I am just unaware of how to push specific input.conf settings. Do I have to make my own "app", and push it?

[JoeSco27]

Yes, you would have to make your own "app" and push it out to your Universal forwarders using deployment-apps.

http://docs.splunk.com/Documentation/Splunk/6.2.3/Updating/Createdeploymentapps