configuring a receiver - cluster master

[sramiz]

hi,

we have following setup

1 cluster master, 3 indexers, 1 deployement server, 3 search heads, 1 Heavy forwarder 

and more than 200 potential splunk forwarder servers (linux and windows)

Plans is to share outputs.conf with those servers owners so they can install  and configure SF on their servers and use this outputs.conf file. The outputs.conf that I created during POC looks like this:

[indexer_discovery:poc-cluster-master]
pass4SymmKey =  {password value}
master_uri = https://poc-cluster-master:8089

[tcpout:poc-clustermastergroup]
autoLBFrequency = 30
forceTimebasedAutoLB = true
indexerDiscovery = poc-cluster-master
useACK = true

[tcpout]
defaultGroup = poc-clustermastergroup

The {dumb} questions i have that how can I share this file with everyone without sharing {password value}.  is this password could be anything or needs to be same as CM admin password and if its than Is there a better way of deploying SF on all servers without sharing this password? puppet?

Any tweak or suggestion to make this stanza better (not necessarily prettier)  performance wise.

regards,

SR

[scelikok]

Hi @sramiz,

Don't worry, yes correct. You can refer to the below document.

https://docs.splunk.com/Documentation/Splunk/8.1.1/Updating/ConfigureDeploymentClients#Configure_dep...

[scelikok · Accepted solution]

Hi @sramiz,

You don't need to distribute outputs.conf manually. Since all your Universal Forwarders will connect to Deployment Server, the only parameter you have to give to everyone is deployment server fqdn or ip address. Once Universal Forwarder contacts to deployment server, you can create a server class to distribute outputs.conf with other settings like inputs.conf etc.

Sample deploymentclient.conf

[deployment-client]

[target-broker:deploymentServer]
# Change the targetUri
targetUri = deploymentserver.splunk.mycompany.com:8089

[sramiz]

@scelikok Thanks for your prompt message. I am new to using splunk and have another dumb question to ask.

first step is to install SF on servers than configure to use DS and than push the settings (outputs.conf) using DF, right?