i followed the install instructions for the installation of the splunk UF in our Citrix environment.
We used this command for the installation on the master. msiexec.exe /i splunkforwarder-7.0.3-fa31da744b51-x64-release.msi DEPLOYMENT_SERVER="<IP ADDRESS>:8089" AGREETOLICENSE=yes LAUNCHSPLUNK=0 /quiet
The preperation of the master image works fine.
After we start the first provisioned server with this image, we saw that the UF communicates with the deployment server and received the prepared inputs.conf, outputs.conf. And a few minutes later we received some events from the event log on the indexer. So far everythings works as expected.
But if we restart the provisioned server, the image of the server will be reseted and therefore the previosly generated "GUID" of the server is gone. After the splunk UF service is started again, the service will generate a new guid.
On the splunk master server in the Forwarders:Deployment menu we see for each reboot a new entry of the UF for the provisioned server.
Is there a way to set to the provisioned servers always the same guid? Is it possible to deploy the instance.cfg by the deployment server?
we found a solution for our environment. It is pretty simple. We wrote a powershell script which is executed every startup of the provisioned servers. This script make the following changes:
- remove the file "cloneprep"
- add or replace the hostname from "inputs.conf"
- add or replace the servername from "server.conf"
- create or change the "instances.cfg" with a self created guid.
We test this a couple of times and it looks like to work fine. The logfiles from the UF are looking good. No errors or warnings regarding the self created GUID.
After all these changes from the configuration part, the script checks the successfull changes and startup the SplunkForwarder service on the server.
For the moment our problem is solved with this script but if someone has another approach, please let me know.