Splunk Enterprise Server Change of Domain

[ws]

Hi,

I would like to request further assistance regarding the following.

If I intend to change the domain of my existing All-in-One Splunk Enterprise server, what are the key areas I should be aware of, and which configuration files need to be updated?

[ws]

@PrewinThomas

Thanks for providing the information. I'll take note of if require performing the domain change.

But if there happen to be deployment clients connected, I'll need to update the outputs.conf to the new destination, right??

[PrewinThomas]

@ws 

Absolutely. You'll need to update the outputs.conf file on all forwarders that send data to this server.
Additionally, if this server is functioning as a deployment server, make sure to update the deploymentclient.conf file on the relevant clients as well.

You can also consider using a DNS alias approach(depends on your environment) if you anticipate changing hostnames again in the future, without interrupting the forwarders splunk confs.

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[ws]

Based on my current understanding, the following:

- The domain name will be changed from splunk.test1.com to splunk.test2.com.

- Splunk is installed on a RHEL (Red Hat Enterprise Linux) operating system.

- Network devices are forwarding data directly to the Splunk All-in-One (AIO) instance.

- There are currently no deployment clients connected.

- No API calls are being utilized at this time.

[PrewinThomas · Accepted solution]

@ws 

In that case mainly you need to update these .confs what i remember,

-server.conf -Update serverName = splunk.test2.com
-inputs.conf -Update host=splunk.test2.com if it were set with old name
-web.conf -Update mgmtHostPort if it reference old name
-SSL certs -Regenerate certs with new hostname if HTTPS is used

Also check network devices configured with this new hostname/IP and update DNS records,Firewall rules if applcicable.

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[PrewinThomas]

@ws 

It will be very helpful if you can share more details on your architecture and setup.

Changing the Windows domain membership affects things like

-Domain-based authentication (LDAP/SSO)
-Group policies
-Firewall rules etc..

Changing the FQDN affects:
-Internal hostname resolution
-SSL cert identity
-Forwarder and peer configurations if they reference FQDN directly
-REST API calls, HEC endpoints, scripted inputs if there's any
-And yes, if deployment clients connect to this instance.

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[livehybrid]

Hi @ws 

When you refer to changing the domain, do you mean that this is a Windows AIO Splunk instance and you're changing the domain that the server lives in? Or is it the FQDN of the servername etc that you want to change?

Do you have any deployment clients connecting to your Splunk instance? 

Please give us a little more detail about your overall architecture so that I can drill down further.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing