Getting Data In

How to push out a configuration change to Windows universal forwarders' outputs.conf to point to a different index using a deployment server?

ii_splunk
Path Finder

I have a Splunk enterprise indexer with about 900 windows servers on a particular index. I created a new index which I need to point 300 of the 900 servers.

I’ve seen some threads in the splunk community on how to push the change out the outputs.conf using linux clients. However, in my case I am using Windows.

Can you please advise as to how we can push out this mod to the windows UF’s to point to a different index?

0 Karma

jimodonald
Contributor

It really should be the same process... update the outputs.conf in the app associated with the Windows servers and reload your deployment server.

Also check serverclass.conf file and validate that the Windows servers will restart the Splunk forwarder with restartSplunkd=true for that class.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!