What are the steps to configure SSH certificate when deploying for 2 new applications into splunk environment?

[raj_mpl]

Hello All,

Nearly 30+ application servers are configured into the splunk environment (30 forwarders,2 Indexers (one indexer as deployment server also a search head) , with all their SSL certificates enabled between them

My question is if we want to add 2 more application server logs to an already existing splunk environment ,
1.what are the steps we need to follow ?
2.manly what about the SSL certificate ?
3. Is it TURE that is it possible to start the UF by making the appropriate configurations in it when it connects to indexer it will automatically inherit the SSL configurations ?

[raj_mpl]

Thank you very much @renjith.nair ...
1.In order to send the cofigurations via deployment server , I need to touch the splunk main server and follow http://docs.splunk.com/Documentation/Splunk/7.1.2/Updating/Createdeploymentapps
2.If the log files residing location is not going to change for long time is it best practice to keep the inputs and outputs conf files in UF (where as all the current 30 application servers are configured via deployment server only )

[renjith_nair · Accepted solution]

@raj_mpl ,

To add new application servers to the existing splunk deployment:

• Install splunk forwarder on the application server and configure
  http://docs.splunk.com/Documentation/Forwarder/7.1.2/Forwarder/Installtheuniversalforwardersoftware

• Configure your outputs.conf with SSL information depending on your choice of certificate(default/self/thir party)
  https://docs.splunk.com/Documentation/Splunk/7.1.2/Security/ConfigureSplunkforwardingtousesignedcert...

For automatic ssl configurations:

• You could use your deployment server to configure outputs.conf including the SSL configurations once your forwarder is connected to the deployment server http://docs.splunk.com/Documentation/Splunk/7.1.2/Updating/Configuredeploymentclients
• You might need to create a separate app to distribute your outputs.conf (you should have this in your deployment server if other forwarders are configured using deployment server)
• set restartSplunkd=true for the serverclass containing this app References :https://answers.splunk.com/answers/65791/changing-uf-outputs-conf-using-deployment-server.html