Does this vulnerability include installs of the universal forwarders for the versions listed (5.0.4 and earlier) or does this pertain to only full versions of Splunk. ... View more

I have a client system that we are splunking who is using a set of heavy forwarders. Our Splunk system does not have access to their universal forwarders. When deployment is conducted from my system to their Heavies the admins of the Heavies take the updated files deployed to their etc/apps and then copy them to their /etc/deployment-apps prior to deploying them out to their universal forwarders. Is it possible to symbolically link the conf files that get deployed, in their etc/apps dir, to their etc/deployment-apps so that when I deploy to them their intermediate step of having to copy those files from apps to deployment-apps is eliminated? As a further step is it possible when I deploy to their Heavies, to kick off a script on their Heavies to run the "splunk reload deploy-server -class" command thereby eliminating the necessity of having to duplicate efforts on a system that I dont actually have access too. ... View more