We have a master image controlling 10 Citrix XenApp hosts, We have deployed Splunk Universal Forwarders via master image, however, all the UF's are reporting with the same master image name. From configuration files,
$SPLUNK_HOME/etc/system/local/inputs.conf
[default]
host=<master image Name>
$SPLUNK_HOME/etc/system/local/server.conf
[general]
serverName=<master image name>
If we fix these individually on the servers, that is updated...however, after rebooting the server, it downloads the master image then it all overwrites. Please advise on how to manage this scenario? Is there any way to update hostname while starting Splunk on the server?
... View more