Pointing universal forwarder to new deployment server

[munazir]

I have installed new Splunk deployment server. I would like to point the universal forwarder resides on client to the newly installed Splunk deployment server. Where do I edit?

\Program Files\SplunkUniversalForwarder\etc\system\local\deploymentclient.conf or output.conf?

[kristian_kolb]

deploymentclient.conf is where you instruct a Splunk Forwarder where to look for its configurations. Just make sure that you have the right applications/serverclass memberships configured on the new deployment server before you make the switch.

outputs.conf is where the Splunk stores configurations regarding where to send events. It is not uncommon to deploy the outputs.conf as an application through the deployment server. NB: if you do, then that outputs.conf will land in $SPLUNK_HOME/etc/apps/your_app_name/local_or_default/outputs.conf. This location has lower precedence than $SPLUNK_HOME/etc/system/local, so ensure that you don't have conflicting configuration there.

---

UPDATE:

There seems to some confusion regarding concepts. A Deployment Server will not necessarily accept incoming log data sent from a forwarder. It is a role that any Splunk server can have, and it means that it will listen on port 8089 (by default) for incoming requests from Deployment Clients. If the DS has a newer version of an application that the deplyment client is supposed to have, it will instruct the deployment client to download it.

An Indexer will listen on one or several ports for incoming log data. Data coming from forwarders are usually received on port 9997, but that is totally configurable (in inputs.conf on the indexer).

So you can in a way say that the outputs.conf on the forwarder maps to inputs.conf on an indexer, and that deploymentclient.conf on a forwarder maps to serverclass.conf (class membership) and server.conf (listening port) on the Deployment Server.

But of course, a single Splunk instance can be an Indexer and Deployment Server at the same time.

So if you already configure your outputs.conf through the deployment server, you should edit it on the DS, in $SPLUNK_HOME/etc/deployment-apps/your_app_name/local_or_default/outputs.conf. When you restart your DS, or run splunk reload deploy-server in the CLI, the new configuration will be active. In a few minutes the forwarder should have the new config.

Hope this helps,

K

[munazir]

my intention is to forward the event to the new deployment server. Where and Which conf file should I edit? Universal forwarder at client or at the conf file at deployment server?