Getting Data In

What script should I use to upgrade multiple universal forwarders on Linux?

rgadepal
New Member

Hi,

I am looking to upgrade multiple universal forwarders installed on Linux OS at one go.
Could you please help me with the script I should use and the detailed steps on how to use that script?

Note: I have a standalone Splunk indexer.

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rgadepal,
as you can see in the Splunk ideas, there's in analysis the possibility to add this feature to Deployment Server, but at the moment the esiest way is to use a tool (third-party management tool like Ansible, Puppet, etc.) otherwise you can use a script that installs one Universal Forwarder at a time, if you want to parallelize UFs installation you can run it more times:

Script

 #!/bin/sh
 # Script to remotely install Splunk forwarder

 # to avoid to store readable password
 read -s -p "Enter Splunk Admin Password: " PASSWORD
 echo 

 # Configuration file
 source /home/your_user/config.ini

 # Command lists to execute in remote forwarder server
 REMOTESCRIPT="
 cd $DIRDEST
 $WGETCMD
 sudo tar -xzf $FWDTGZ
 sudo chown -R splunk:splunk $DIRDEST/splunkforwarder
 sudo -H -u splunk $DIRDEST/splunkforwarder/bin/splunk start --accept-license --answer-yes --auto-ports --no-prompt
 sudo $DIRDEST/splunkforwarder/bin/splunk edit user admin -password $PASSWORD -auth admin:changeme
 sudo $DIRDEST/splunkforwarder/bin/splunk set deploy-poll \"$DEPLOYSERVER\" -auth admin:$PASSWORD
 sudo $DIRDEST/splunkforwarder/bin/splunk enable boot-start -user splunk
 sudo chown -R splunk:splunk $DIRDEST/splunkforwarder
 sudo -H -u splunk $DIRDEST/splunkforwarder/bin/splunk restart
 "

 # Installation execution
 echo "============================= FORWARDER REMOTE INSTALLER ============================="
 echo
 sleep 5
 echo "Reading host logins from $TARGETSFILE"
 echo 
 echo "Start Forwarder remote installation to:"

 # hosts cycle
 for DEST in `cat "$TARGETSFILE"`; do

     if [ -z "$DEST" ]; then
         continue;
     fi
     echo 
     echo "- $DEST"
     ssh "$DEST" "$REMOTESCRIPT"

 done

Config.ini

 TARGETSFILE="/home/my_user/targets.ini"
 DIRDEST="/opt"
 WGETCMD="sudo wget -O splunkforwarder-your_version.tgz 'your_link"
 FWDTGZ="/opt/splunkforwarder-your_version.tgz"
 DEPLOYSERVER="your_Deployment_Server:8089"

Adapt the script to your needs.
In addition you could insert your host list in another file and read them from it.
Another hint is to copy in $SPLUNK_HOME/etc/apps a Technical Add-on in which there are two files: outputs.conf and deploymentclient.conf, in this way your Forwarders will connect directly to you Deployment Server and you can manage them

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...