Getting Data In

How to set the site during Universal Forwarder installation for a Splunk 6.3 multisite indexer cluster?

karlbosanquet
Path Finder

I am deploying Universal Forwarders by either Puppet or SCCM to multiple hosts. They will be forwarding to a 6.3.0 multisite indexer cluster.

Is there a way to set site=site0 in the system/local/server.conf to save having to log into each server to update this flag?

0 Karma
1 Solution

maciep
Champion

first off, do you need to set it to that on your universal forwarders. Can't you just configure your outputs.conf to send data to all of your indexers in the cluster? I thought the site0 functionality was just for search head affinity but could be wrong.

That said, you could just deploy an app with your specific server.conf settings along with the uf install. So install install the uf, copy the app to etc/apps and restart splunk.

And depending on how many forwarders you will be managing, you may benefit from implementing the splunk deployment server. Or you could just use puppet/sccm to manage configurations similarly.

View solution in original post

maciep
Champion

first off, do you need to set it to that on your universal forwarders. Can't you just configure your outputs.conf to send data to all of your indexers in the cluster? I thought the site0 functionality was just for search head affinity but could be wrong.

That said, you could just deploy an app with your specific server.conf settings along with the uf install. So install install the uf, copy the app to etc/apps and restart splunk.

And depending on how many forwarders you will be managing, you may benefit from implementing the splunk deployment server. Or you could just use puppet/sccm to manage configurations similarly.

karlbosanquet
Path Finder

Creating an outputs.conf with just the general stanza and site flag in an app which I push from a deployer did the trick.

I am using a multi site index cluster so the outputs.conf created in a barebones install points to the index cluster master which requires site details. The process above means I can deploy a barebones forwarder to any server and update all the required settings via the app deployment process.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...