Getting Data In

How to set the site during Universal Forwarder installation for a Splunk 6.3 multisite indexer cluster?

karlbosanquet
Path Finder

I am deploying Universal Forwarders by either Puppet or SCCM to multiple hosts. They will be forwarding to a 6.3.0 multisite indexer cluster.

Is there a way to set site=site0 in the system/local/server.conf to save having to log into each server to update this flag?

0 Karma
1 Solution

maciep
Champion

first off, do you need to set it to that on your universal forwarders. Can't you just configure your outputs.conf to send data to all of your indexers in the cluster? I thought the site0 functionality was just for search head affinity but could be wrong.

That said, you could just deploy an app with your specific server.conf settings along with the uf install. So install install the uf, copy the app to etc/apps and restart splunk.

And depending on how many forwarders you will be managing, you may benefit from implementing the splunk deployment server. Or you could just use puppet/sccm to manage configurations similarly.

View solution in original post

maciep
Champion

first off, do you need to set it to that on your universal forwarders. Can't you just configure your outputs.conf to send data to all of your indexers in the cluster? I thought the site0 functionality was just for search head affinity but could be wrong.

That said, you could just deploy an app with your specific server.conf settings along with the uf install. So install install the uf, copy the app to etc/apps and restart splunk.

And depending on how many forwarders you will be managing, you may benefit from implementing the splunk deployment server. Or you could just use puppet/sccm to manage configurations similarly.

karlbosanquet
Path Finder

Creating an outputs.conf with just the general stanza and site flag in an app which I push from a deployer did the trick.

I am using a multi site index cluster so the outputs.conf created in a barebones install points to the index cluster master which requires site details. The process above means I can deploy a barebones forwarder to any server and update all the required settings via the app deployment process.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...