Modify Splunk UF Configs on Splunk Cloud

[matthew-miller]

I'm working to modify UF configs (inputs.conf I believe) on masse using the Splunk Cloud platform. The first idea I had was to use a GPO, but we have servers outside the domain.

[gcusello]

Hi @matthew-miller,

you can modify UF configurations using a Deployment Server that you should install in your infrastructure, In my opinion you cannot use Splunk Cloud as Deployment Server because there are some activities that must be done by SSH and you cannot access Splunk Cloud in SSH.

If you have windows machines, you could use a GPO, but in this case you don't need help from a Splunk specialist but from a Windows Specialist.

If you have Linux machines you could use a script that you can find in community, tell me if you need it.

Ciao.

Giuseppe