When I installed the Splunk Universal Forwarder for Windows, the inputs.conf file has the stanza;
[default]
host = <actual host name>
I want to make the Splunk Forwarder directories on this server part of an image to load onto other servers. So what do I change this stanza to, if anything, to get it to use the name of the server that it's being loaded on?
Just delete the host=
line from the file in your master image and splunk will automatically figure it out when you deploy the file and (re)start splunk.
In the spec, found at http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf
it shows that the value in system/default/inputs.conf is $decideOnStartup
On first run this will write to system/local. You can prestage that value in the system/local (or override system/default with an app) so that the UF polls the OS every time it starts.
Just delete the host=
line from the file in your master image and splunk will automatically figure it out when you deploy the file and (re)start splunk.
This seemed to work. I commented out the "host =" and "serverName =" lines in the "inputs.conf" and "server.conf" files respectively and the Forwarder serrvice did start this time and it was named correctly in the Deployment server when it "Phoned Home". But I noticed that the "inputs.conf" and "server.conf" files were not updated. I assume the Splunk Forwarder is looking someplace else for the default server name.
Anyway, thanks.
I just noticed that in the same directory, in the server.conf file, I have the following stanza;
[general]
pass4SymmKey = <Pass key number>
serverName = <actual host name>
I'm going to have to change that also. But to what?