Getting Data In

Installation Universal Forwarder on Citrix Provisioning servers-Is there a way to set the servers to same guid?

krusty
Contributor

Hi there,

i followed the install instructions for the installation of the splunk UF in our Citrix environment.
We used this command for the installation on the master.
msiexec.exe /i splunkforwarder-7.0.3-fa31da744b51-x64-release.msi DEPLOYMENT_SERVER="<IP ADDRESS>:8089" AGREETOLICENSE=yes LAUNCHSPLUNK=0 /quiet

The preperation of the master image works fine.

After we start the first provisioned server with this image, we saw that the UF communicates with the deployment server and received the prepared inputs.conf, outputs.conf. And a few minutes later we received some events from the event log on the indexer. So far everythings works as expected.

But if we restart the provisioned server, the image of the server will be reseted and therefore the previosly generated "GUID" of the server is gone. After the splunk UF service is started again, the service will generate a new guid.
On the splunk master server in the Forwarders:Deployment menu we see for each reboot a new entry of the UF for the provisioned server.

Is there a way to set to the provisioned servers always the same guid? Is it possible to deploy the instance.cfg by the deployment server?

Any help / info is welcome.

Thanks.

Labels (1)
0 Karma

krusty
Contributor

Just for information,

we found a solution for our environment. It is pretty simple. We wrote a powershell script which is executed every startup of the provisioned servers. This script make the following changes:
- remove the file "cloneprep"
- add or replace the hostname from "inputs.conf"
- add or replace the servername from "server.conf"
- create or change the "instances.cfg" with a self created guid.

We test this a couple of times and it looks like to work fine. The logfiles from the UF are looking good. No errors or warnings regarding the self created GUID.

After all these changes from the configuration part, the script checks the successfull changes and startup the SplunkForwarder service on the server.

For the moment our problem is solved with this script but if someone has another approach, please let me know.

LL
Observer

Can you post your powershell script? I can do the rest but I'm curious as to how you:

create or change the "instances.cfg" with a self created guid 

0 Karma

mkalyakin
Explorer

Hello @krusty !

Have you found any other way to solve this problem?

Can you please also provide powershell script that you wrote? 

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...