Getting Data In

universal forwarder change deployment server use deployment

love0sxy
Explorer
Hello, guys I want change my universal forward for new deployment_server,how to use Current deployment server。 I am currently pushing the app for universal forwarder, but can‘t change deployment_server
Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @love0sxy,

if you want to manage deploymentclient.conf by Deployment Server you have to follow the procedure I described in my previous answer because files in $SPLUNK_HOME/etc/system/local folder aren't manageable by DS, for this reason the changes aren't effective.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @love0sxy,

how did you configure the deploymentclient.conf file in your UFs?

if this file in in a custom Add-On deployed using the Deployment Server, you can modify this file in the app to deploy and the new addressing is deployed to all the UFs.

If instead you configured it using the CLI command and the deploymentclient.conf file is in $SPLUNK_HOME/etc/system/local, there isn't any automatic way to change the DS addressing.

In this case, you could deploy an add-on containing this file using the old DS and run a remote script that deletes the old deploymentclient.conf file and restarts Splunk.

Ciao.

Giuseppe

0 Karma

love0sxy
Explorer

hi! Esteemed Legend
 I thank know Manually changing files for uf /etc/system/local/deploymentclient,
and restar splunkd.exe it can change deployment server

love0sxy_0-1694700403560.png

but  i use deployment server push a newpath a deploymentclient.conf to UF is Not effective 

love0sxy_1-1694700574693.png

 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @love0sxy,

if you want to manage deploymentclient.conf by Deployment Server you have to follow the procedure I described in my previous answer because files in $SPLUNK_HOME/etc/system/local folder aren't manageable by DS, for this reason the changes aren't effective.

Ciao.

Giuseppe

0 Karma

love0sxy
Explorer
According to the method you mentioned, the problem has been successfully solved. Thank you very much 🙂
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @love0sxy ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...