Getting Data In

configuring a receiver - cluster master

sramiz
Path Finder

hi,

we have following setup

1 cluster master, 3 indexers, 1 deployement server, 3 search heads, 1 Heavy forwarder 

and more than 200 potential splunk forwarder servers (linux and windows)

Plans is to share outputs.conf with those servers owners so they can install  and configure SF on their servers and use this outputs.conf file. The outputs.conf that I created during POC looks like this:

 

[indexer_discovery:poc-cluster-master]
pass4SymmKey =  {password value}
master_uri = https://poc-cluster-master:8089

[tcpout:poc-clustermastergroup]
autoLBFrequency = 30
forceTimebasedAutoLB = true
indexerDiscovery = poc-cluster-master
useACK = true

[tcpout]
defaultGroup = poc-clustermastergroup

 

 

The {dumb} questions i have that how can I share this file with everyone without sharing {password value}.  is this password could be anything or needs to be same as CM admin password and if its than Is there a better way of deploying SF on all servers without sharing this password? puppet?

Any tweak or suggestion to make this stanza better (not necessarily prettier)  performance wise.

regards,

SR

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @sramiz,

You don't need to distribute outputs.conf manually. Since all your Universal Forwarders will connect to Deployment Server, the only parameter you have to give to everyone is deployment server fqdn or ip address. Once Universal Forwarder contacts to deployment server, you can create a server class to distribute outputs.conf with other settings like inputs.conf etc.

Sample deploymentclient.conf

[deployment-client]

[target-broker:deploymentServer]
# Change the targetUri
targetUri = deploymentserver.splunk.mycompany.com:8089
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @sramiz,

Don't worry, yes correct. You can refer to the below document.

https://docs.splunk.com/Documentation/Splunk/8.1.1/Updating/ConfigureDeploymentClients#Configure_dep...

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @sramiz,

You don't need to distribute outputs.conf manually. Since all your Universal Forwarders will connect to Deployment Server, the only parameter you have to give to everyone is deployment server fqdn or ip address. Once Universal Forwarder contacts to deployment server, you can create a server class to distribute outputs.conf with other settings like inputs.conf etc.

Sample deploymentclient.conf

[deployment-client]

[target-broker:deploymentServer]
# Change the targetUri
targetUri = deploymentserver.splunk.mycompany.com:8089
If this reply helps you an upvote and "Accept as Solution" is appreciated.

sramiz
Path Finder

@scelikok Thanks for your prompt message. I am new to using splunk and have another dumb question to ask.

first step is to install SF on servers than configure to use DS and than push the settings (outputs.conf) using DF, right?

 

 

 

 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...