Getting Data In

configuring a receiver - cluster master

sramiz
Path Finder

hi,

we have following setup

1 cluster master, 3 indexers, 1 deployement server, 3 search heads, 1 Heavy forwarder 

and more than 200 potential splunk forwarder servers (linux and windows)

Plans is to share outputs.conf with those servers owners so they can install  and configure SF on their servers and use this outputs.conf file. The outputs.conf that I created during POC looks like this:

 

[indexer_discovery:poc-cluster-master]
pass4SymmKey =  {password value}
master_uri = https://poc-cluster-master:8089

[tcpout:poc-clustermastergroup]
autoLBFrequency = 30
forceTimebasedAutoLB = true
indexerDiscovery = poc-cluster-master
useACK = true

[tcpout]
defaultGroup = poc-clustermastergroup

 

 

The {dumb} questions i have that how can I share this file with everyone without sharing {password value}.  is this password could be anything or needs to be same as CM admin password and if its than Is there a better way of deploying SF on all servers without sharing this password? puppet?

Any tweak or suggestion to make this stanza better (not necessarily prettier)  performance wise.

regards,

SR

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @sramiz,

You don't need to distribute outputs.conf manually. Since all your Universal Forwarders will connect to Deployment Server, the only parameter you have to give to everyone is deployment server fqdn or ip address. Once Universal Forwarder contacts to deployment server, you can create a server class to distribute outputs.conf with other settings like inputs.conf etc.

Sample deploymentclient.conf

[deployment-client]

[target-broker:deploymentServer]
# Change the targetUri
targetUri = deploymentserver.splunk.mycompany.com:8089
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @sramiz,

Don't worry, yes correct. You can refer to the below document.

https://docs.splunk.com/Documentation/Splunk/8.1.1/Updating/ConfigureDeploymentClients#Configure_dep...

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @sramiz,

You don't need to distribute outputs.conf manually. Since all your Universal Forwarders will connect to Deployment Server, the only parameter you have to give to everyone is deployment server fqdn or ip address. Once Universal Forwarder contacts to deployment server, you can create a server class to distribute outputs.conf with other settings like inputs.conf etc.

Sample deploymentclient.conf

[deployment-client]

[target-broker:deploymentServer]
# Change the targetUri
targetUri = deploymentserver.splunk.mycompany.com:8089
If this reply helps you an upvote and "Accept as Solution" is appreciated.

sramiz
Path Finder

@scelikok Thanks for your prompt message. I am new to using splunk and have another dumb question to ask.

first step is to install SF on servers than configure to use DS and than push the settings (outputs.conf) using DF, right?

 

 

 

 

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...