Getting Data In

How to update outputs.conf on univeral forwarders from Deployment Server

FPERVIL
Explorer

I would like to update my universal forwarders to send data to 2 separate endpoints for 2 separate splunk environments.  How can I do this using my Deployment Server.  I already have an App that I will use for UF update.

Labels (1)
Tags (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @FPERVIL ,

I usually deploy on all the Forwarders an app, usually called TA_Forwarders, containing at least three files:

  • app.conf
  • deploymentclient.conf,
  • outputs.conf.

in this way I can centrally manage both sending data to Indexers and Conncection to Deployment Server.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...