Getting Data In

configuring a receiver - cluster master

sramiz
Path Finder

hi,

we have following setup

1 cluster master, 3 indexers, 1 deployement server, 3 search heads, 1 Heavy forwarder 

and more than 200 potential splunk forwarder servers (linux and windows)

Plans is to share outputs.conf with those servers owners so they can install  and configure SF on their servers and use this outputs.conf file. The outputs.conf that I created during POC looks like this:

 

[indexer_discovery:poc-cluster-master]
pass4SymmKey =  {password value}
master_uri = https://poc-cluster-master:8089

[tcpout:poc-clustermastergroup]
autoLBFrequency = 30
forceTimebasedAutoLB = true
indexerDiscovery = poc-cluster-master
useACK = true

[tcpout]
defaultGroup = poc-clustermastergroup

 

 

The {dumb} questions i have that how can I share this file with everyone without sharing {password value}.  is this password could be anything or needs to be same as CM admin password and if its than Is there a better way of deploying SF on all servers without sharing this password? puppet?

Any tweak or suggestion to make this stanza better (not necessarily prettier)  performance wise.

regards,

SR

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @sramiz,

You don't need to distribute outputs.conf manually. Since all your Universal Forwarders will connect to Deployment Server, the only parameter you have to give to everyone is deployment server fqdn or ip address. Once Universal Forwarder contacts to deployment server, you can create a server class to distribute outputs.conf with other settings like inputs.conf etc.

Sample deploymentclient.conf

[deployment-client]

[target-broker:deploymentServer]
# Change the targetUri
targetUri = deploymentserver.splunk.mycompany.com:8089
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @sramiz,

Don't worry, yes correct. You can refer to the below document.

https://docs.splunk.com/Documentation/Splunk/8.1.1/Updating/ConfigureDeploymentClients#Configure_dep...

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @sramiz,

You don't need to distribute outputs.conf manually. Since all your Universal Forwarders will connect to Deployment Server, the only parameter you have to give to everyone is deployment server fqdn or ip address. Once Universal Forwarder contacts to deployment server, you can create a server class to distribute outputs.conf with other settings like inputs.conf etc.

Sample deploymentclient.conf

[deployment-client]

[target-broker:deploymentServer]
# Change the targetUri
targetUri = deploymentserver.splunk.mycompany.com:8089
If this reply helps you an upvote and "Accept as Solution" is appreciated.

sramiz
Path Finder

@scelikok Thanks for your prompt message. I am new to using splunk and have another dumb question to ask.

first step is to install SF on servers than configure to use DS and than push the settings (outputs.conf) using DF, right?

 

 

 

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...