Getting Data In

How to remotely install and configure a universal forwarder to point to 1 of 10 intermediate forwarders?

glasscoj
Engager

Is there a way to remotely install universal forwarders using a command line push that would allow multiple intermediate forwarders listed, but the UF would only send to the intermediate forwarder that is available? (We have a very segmented network, with many Intermediate forwarders, and would like to automatic push configs to about 1000 servers.)

0 Karma

thomrs
Communicator

Yes there is, below is a link to the CLI docs. I use a script to install our UF's and set the basics. The rest of the configs is then downloaded from our delivery server. You can add multiple forward-servers and the UF will round-robin them.

http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/SupportedCLIcommands

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!