Is there way to push and install splunk forwarder to multiple Linux servers at same time?
If you have script please provide me.
the esiest way is to use a tool (as suggested by @richgalloway) otherwise you can use a script that installs one Universal Forwarder at a time, if you want to parallelize UFs installation you can run it more times:
#!/bin/sh # Script to remotely install Splunk forwarder # to avoid to store readable password read -s -p "Enter Splunk Admin Password: " PASSWORD echo # Configuration file source /home/your_user/config.ini # Command lists to execute in remote forwarder server REMOTESCRIPT=" cd $DIRDEST $WGETCMD sudo tar -xzf $FWDTGZ sudo chown -R splunk:splunk $DIRDEST/splunkforwarder sudo -H -u splunk $DIRDEST/splunkforwarder/bin/splunk start --accept-license --answer-yes --auto-ports --no-prompt sudo $DIRDEST/splunkforwarder/bin/splunk edit user admin -password $PASSWORD -auth admin:changeme sudo $DIRDEST/splunkforwarder/bin/splunk set deploy-poll \"$DEPLOYSERVER\" -auth admin:$PASSWORD sudo $DIRDEST/splunkforwarder/bin/splunk enable boot-start -user splunk sudo chown -R splunk:splunk $DIRDEST/splunkforwarder sudo -H -u splunk $DIRDEST/splunkforwarder/bin/splunk restart " # Installation execution echo "============================= FORWARDER REMOTE INSTALLER =============================" echo sleep 5 echo "Reading host logins from $TARGETSFILE" echo echo "Start Forwarder remote installation to:" # hosts cycle for DEST in `cat "$TARGETSFILE"`; do if [ -z "$DEST" ]; then continue; fi echo echo "- $DEST" ssh "$DEST" "$REMOTESCRIPT" done
TARGETSFILE="/home/my_user/targets.ini" DIRDEST="/opt" WGETCMD="sudo wget -O splunkforwarder-your_version.tgz 'your_link" FWDTGZ="/opt/splunkforwarder-your_version.tgz" DEPLOYSERVER="your_Deployment_Server:8089"
Adapt the script to your needs.
In addition you could insert your host list in another file and read them from it.
Another hint is to copy in $SPLUNK_HOME/etc/apps a Technical Add-on in which there are two files: outputs.conf and deploymentclient.conf, in this way your Forwarders will connect directly to you Deployment Server and you can manage them
did the answer solve your need?
if yes, please accept it for other people of Community, if not tell me what's the problem.
There is no Splunk solution for that. Use a third-party management tool like Ansible, Puppet, etc.