Getting Data In

How to push out a configuration change to Windows universal forwarders' outputs.conf to point to a different index using a deployment server?

Path Finder

I have a Splunk enterprise indexer with about 900 windows servers on a particular index. I created a new index which I need to point 300 of the 900 servers.

I’ve seen some threads in the splunk community on how to push the change out the outputs.conf using linux clients. However, in my case I am using Windows.

Can you please advise as to how we can push out this mod to the windows UF’s to point to a different index?

0 Karma


It really should be the same process... update the outputs.conf in the app associated with the Windows servers and reload your deployment server.

Also check serverclass.conf file and validate that the Windows servers will restart the Splunk forwarder with restartSplunkd=true for that class.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!