Is there a way to clear down the config of an installed UF and then point it to the distribution server for new configs?

[anapp]

Hi All

I need a way to clear down the config of an installed UF and then point it to the distribution server and pick up new/refreshed configs

Apart from uninstalling, removing files and re-installing the UF is there a clever way of doing this

(background, we've a number of hosts reporting in as the wrong hostname, and want to sort them out)

Cheers

Al

[VatsalJagani]

@anapp - Write a shell script for Linux/Unix devices and CMD/PowerShell scripts for Windows devices.

• Create a custom App on current deployment server.
• Write this script as Splunk scripted input. 
• What does this script do:
  • Update the configuration file to point to the new deployment server.
  • Splunk Restart.
    • Because your script is running as a child process of Splunk it cannot restart Splunk successfully.
    • So you need to run it under the wrapper script. Here is an example to start with:

#!/bin/bash

SCRIPT=`/usr/bin/realpath $0`
SCRIPTPATH=`/usr/bin/dirname $SCRIPT`
echo "Executing $SCRIPTPATH/my_script.sh $SPLUNK_HOME" >&2
(exec /usr/bin/setsid /usr/bin/sh $SCRIPTPATH/my_script.sh $SPLUNK_HOME &)

• And then use wrapper script as Scripted input.
• Make sure to keep the new configuration ready on the new deployment server beforehand.

Kindly upvote if this helps!!!

[anapp]

thanks - useful but not quite what I need, I should have been more specific 🙂

We seem to have some servers built from a template whereby they are "reporting in" as the wrong servername.  I assumed I could correct the local\server.conf to correct this but that doesn't seem to fix the issue.

So I'm looking for as general as possible "wipe" of local config so it only knows the deployment server and starts afresh

[richgalloway]

When you created the template did you run splunk clone-prep-clear-config first?  That command removes the unique identifiers for the UF so it can be replicated to multiple target systems.  See https://docs.splunk.com/Documentation/Splunk/9.0.4/Admin/Integrateauniversalforwarderontoasystemimag...

[anapp]

let's just say the team responsible do that _now_ 🙂