Getting Data In

configuring a receiver - cluster master

sramiz
Path Finder

hi,

we have following setup

1 cluster master, 3 indexers, 1 deployement server, 3 search heads, 1 Heavy forwarder 

and more than 200 potential splunk forwarder servers (linux and windows)

Plans is to share outputs.conf with those servers owners so they can install  and configure SF on their servers and use this outputs.conf file. The outputs.conf that I created during POC looks like this:

 

[indexer_discovery:poc-cluster-master]
pass4SymmKey =  {password value}
master_uri = https://poc-cluster-master:8089

[tcpout:poc-clustermastergroup]
autoLBFrequency = 30
forceTimebasedAutoLB = true
indexerDiscovery = poc-cluster-master
useACK = true

[tcpout]
defaultGroup = poc-clustermastergroup

 

 

The {dumb} questions i have that how can I share this file with everyone without sharing {password value}.  is this password could be anything or needs to be same as CM admin password and if its than Is there a better way of deploying SF on all servers without sharing this password? puppet?

Any tweak or suggestion to make this stanza better (not necessarily prettier)  performance wise.

regards,

SR

Labels (1)
0 Karma
1 Solution

scelikok
Champion

Hi @sramiz,

You don't need to distribute outputs.conf manually. Since all your Universal Forwarders will connect to Deployment Server, the only parameter you have to give to everyone is deployment server fqdn or ip address. Once Universal Forwarder contacts to deployment server, you can create a server class to distribute outputs.conf with other settings like inputs.conf etc.

Sample deploymentclient.conf

[deployment-client]

[target-broker:deploymentServer]
# Change the targetUri
targetUri = deploymentserver.splunk.mycompany.com:8089
If this reply helps you an upvote is appreciated.

View solution in original post

scelikok
Champion

Hi @sramiz,

Don't worry, yes correct. You can refer to the below document.

https://docs.splunk.com/Documentation/Splunk/8.1.1/Updating/ConfigureDeploymentClients#Configure_dep...

 

If this reply helps you an upvote is appreciated.
0 Karma

scelikok
Champion

Hi @sramiz,

You don't need to distribute outputs.conf manually. Since all your Universal Forwarders will connect to Deployment Server, the only parameter you have to give to everyone is deployment server fqdn or ip address. Once Universal Forwarder contacts to deployment server, you can create a server class to distribute outputs.conf with other settings like inputs.conf etc.

Sample deploymentclient.conf

[deployment-client]

[target-broker:deploymentServer]
# Change the targetUri
targetUri = deploymentserver.splunk.mycompany.com:8089
If this reply helps you an upvote is appreciated.

View solution in original post

sramiz
Path Finder

@scelikok Thanks for your prompt message. I am new to using splunk and have another dumb question to ask.

first step is to install SF on servers than configure to use DS and than push the settings (outputs.conf) using DF, right?

 

 

 

 

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.