Getting Data In

How to use deployment server to update clients without overriding changes we'll be making to our Splunk Server's IP?

gnoellbn
Explorer

A while ago we have deployed about a 1000+ Universal Forwarder over our network, not knowing about deployment server. So all basic settings are stored in etc/system folder (outputs.conf notably).

Now the issue we have is we will be changing Splunk server's IP, but we cannot use deployment server to update clients as the outputs.conf in etc/system will be overriding all changes we make.

Would anyone have an idea on how we could proceed to change this? I'd also appreciate if we can find a way to remove the outputs.conf settings in etc/system

Thanks

0 Karma
1 Solution

thomrs
Communicator

There are a number of a supported CLI commands. You can script out the changes most likely. I have an install script that sets a number of things this way.

http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/SupportedCLIcommands

View solution in original post

thomrs
Communicator

There are a number of a supported CLI commands. You can script out the changes most likely. I have an install script that sets a number of things this way.

http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/SupportedCLIcommands

gnoellbn
Explorer

Thanks for that, I'll have a look if I can find what I need there

0 Karma

bmacias84
Champion

If you are using DNS entry or FQDN for the Splunk server you could create a cname entry in DNS. If you are on Windows you could write a one time start up script to rename or remove the outputs .conf. Basically your going to have to script the deletion or renaming of the $SPLUNK_HOME/etc/system/local/outputs.conf.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...