Getting Data In

What script should I use to upgrade multiple universal forwarders on Linux?

New Member

Hi,

I am looking to upgrade multiple universal forwarders installed on Linux OS at one go.
Could you please help me with the script I should use and the detailed steps on how to use that script?

Note: I have a standalone Splunk indexer.

Labels (2)
0 Karma

SplunkTrust
SplunkTrust

Hi @rgadepal,
as you can see in the Splunk ideas, there's in analysis the possibility to add this feature to Deployment Server, but at the moment the esiest way is to use a tool (third-party management tool like Ansible, Puppet, etc.) otherwise you can use a script that installs one Universal Forwarder at a time, if you want to parallelize UFs installation you can run it more times:

Script

 #!/bin/sh
 # Script to remotely install Splunk forwarder

 # to avoid to store readable password
 read -s -p "Enter Splunk Admin Password: " PASSWORD
 echo 

 # Configuration file
 source /home/your_user/config.ini

 # Command lists to execute in remote forwarder server
 REMOTESCRIPT="
 cd $DIRDEST
 $WGETCMD
 sudo tar -xzf $FWDTGZ
 sudo chown -R splunk:splunk $DIRDEST/splunkforwarder
 sudo -H -u splunk $DIRDEST/splunkforwarder/bin/splunk start --accept-license --answer-yes --auto-ports --no-prompt
 sudo $DIRDEST/splunkforwarder/bin/splunk edit user admin -password $PASSWORD -auth admin:changeme
 sudo $DIRDEST/splunkforwarder/bin/splunk set deploy-poll \"$DEPLOYSERVER\" -auth admin:$PASSWORD
 sudo $DIRDEST/splunkforwarder/bin/splunk enable boot-start -user splunk
 sudo chown -R splunk:splunk $DIRDEST/splunkforwarder
 sudo -H -u splunk $DIRDEST/splunkforwarder/bin/splunk restart
 "

 # Installation execution
 echo "============================= FORWARDER REMOTE INSTALLER ============================="
 echo
 sleep 5
 echo "Reading host logins from $TARGETSFILE"
 echo 
 echo "Start Forwarder remote installation to:"

 # hosts cycle
 for DEST in `cat "$TARGETSFILE"`; do

     if [ -z "$DEST" ]; then
         continue;
     fi
     echo 
     echo "- $DEST"
     ssh "$DEST" "$REMOTESCRIPT"

 done

Config.ini

 TARGETSFILE="/home/my_user/targets.ini"
 DIRDEST="/opt"
 WGETCMD="sudo wget -O splunkforwarder-your_version.tgz 'your_link"
 FWDTGZ="/opt/splunkforwarder-your_version.tgz"
 DEPLOYSERVER="your_Deployment_Server:8089"

Adapt the script to your needs.
In addition you could insert your host list in another file and read them from it.
Another hint is to copy in $SPLUNK_HOME/etc/apps a Technical Add-on in which there are two files: outputs.conf and deploymentclient.conf, in this way your Forwarders will connect directly to you Deployment Server and you can manage them

Ciao.
Giuseppe

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!