Getting Data In

Servername in local\server.conf

reedmohn
Communicator

OK, so now I know how to deploy UF on a Citrix Golden Image:
http://answers.splunk.com/answers/69715/citrix-golden-image
http://answers.splunk.com/answers/86989/multiple-servers-booting-from-master-image

But I'm curious: The 4.3 documentation only says to replace the "GUID" and the "host" attributes:

Edit server.conf in /etc/system/local and remove the guid attribute.
Edit inputs.conf in /etc/system/local and remove any host attribute.

What about the "servername" attribute in local\server.conf?

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

On the Image, you will probably want to remove that attribute as well. You may be better off running this command ./splunk clone-prep-clear-config on the image. See here for more: http://docs.splunk.com/Documentation/Splunk/5.0.5/Deploy/Makeadfpartofasystemimage

reedmohn
Communicator

I appreciate the feedback, but unless you can actually confirm, or give a reason for what to do, you haven't really answered anything, have you? 🙂

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Tons of fun! Join us on IRC EfNet, channel #splunk for more fun! Also, please accept answer if this has answered your question satisfactorily.

0 Karma

reedmohn
Communicator

Yeah, you know.. time flies when you're having fun.

And people must have an awful lot of fun in enterprise architectures, it seems!

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

I'd recommend upgrading as soon as possible. Support ends for 4.3 EOM.

0 Karma

reedmohn
Communicator

Thanks,
I just found it a little strange that if it is important to change, it isn't in the docs. Hope they haven't forgotten it in the "clone-prep"-command 🙂

In any case, we're still using 4.3, so we'll go with the manual option, I guess.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...