Getting Data In

Install splunk forwarder in Linux servers

aalhabbash1
Path Finder

Hi All;

Is there way to push and install splunk forwarder to multiple Linux servers at same time?
If you have script please provide me.

Thanks

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @aalhabbash1,
the esiest way is to use a tool (as suggested by @richgalloway) otherwise you can use a script that installs one Universal Forwarder at a time, if you want to parallelize UFs installation you can run it more times:
Script

#!/bin/sh
# Script to remotely install Splunk forwarder

# to avoid to store readable password
read -s -p "Enter Splunk Admin Password: " PASSWORD
echo 

# Configuration file
source /home/your_user/config.ini

# Command lists to execute in remote forwarder server
REMOTESCRIPT="
cd $DIRDEST
$WGETCMD
sudo tar -xzf $FWDTGZ
sudo chown -R splunk:splunk $DIRDEST/splunkforwarder
sudo -H -u splunk $DIRDEST/splunkforwarder/bin/splunk start --accept-license --answer-yes --auto-ports --no-prompt
sudo $DIRDEST/splunkforwarder/bin/splunk edit user admin -password $PASSWORD -auth admin:changeme
sudo $DIRDEST/splunkforwarder/bin/splunk set deploy-poll \"$DEPLOYSERVER\" -auth admin:$PASSWORD
sudo $DIRDEST/splunkforwarder/bin/splunk enable boot-start -user splunk
sudo chown -R splunk:splunk $DIRDEST/splunkforwarder
sudo -H -u splunk $DIRDEST/splunkforwarder/bin/splunk restart
"

# Installation execution
echo "============================= FORWARDER REMOTE INSTALLER ============================="
echo
sleep 5
echo "Reading host logins from $TARGETSFILE"
echo 
echo "Start Forwarder remote installation to:"

# hosts cycle
for DEST in `cat "$TARGETSFILE"`; do

    if [ -z "$DEST" ]; then
        continue;
    fi
    echo 
    echo "- $DEST"
    ssh "$DEST" "$REMOTESCRIPT"

done

Config.ini

TARGETSFILE="/home/my_user/targets.ini"
DIRDEST="/opt"
WGETCMD="sudo wget -O splunkforwarder-your_version.tgz 'your_link"
FWDTGZ="/opt/splunkforwarder-your_version.tgz"
DEPLOYSERVER="your_Deployment_Server:8089"

Adapt the script to your needs.
In addition you could insert your host list in another file and read them from it.
Another hint is to copy in $SPLUNK_HOME/etc/apps a Technical Add-on in which there are two files: outputs.conf and deploymentclient.conf, in this way your Forwarders will connect directly to you Deployment Server and you can manage them

Ciao.
Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @aalhabbash1,
did the answer solve your need?
if yes, please accept it for other people of Community, if not tell me what's the problem.

Ciao.
Giuseppe

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is no Splunk solution for that. Use a third-party management tool like Ansible, Puppet, etc.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...