As the title suggests, I am having multiple Universal Forwarders sharing the same Instance GUID due to the mistake of the owners of the servers, as they were just copying the .conf files from servers to servers.
So my question is, what is the impact of this. I think missing the logs from these machines is one of the impact, as every 10-20 seconds, the IP and Hostname change, but the Instance GUID and Instance Name remains the same.
And of course the obvious question, how do I fix this? Solving from the higher level of the system is prefer, like using the deployment server (which I can SSH into), since I have limited access to the servers, and probably have to TeamView them or write a guide for them.
I read that the GUID is now in the `$SPLUNK_HOME/etc/instance.cfg` file, and there is probably a GUID there, which would be the same across the servers. Can I just delete the GUID line and restart the splunk service, and the deployment server would give it a new one?
Can I delete the record from the Deployment Server UI and it would generated a new one and auto update the instance.cfg file of the Forwarder?
I read the docs instance.cfg.conf - Splunk Documentation and it mention not to edit the file, so I am a bit confused.
And I also saw that the docs mentioned that server.conf also has the GUID value, so do I have to do anything in the server.conf file?
