Hi @gcusello , 2) you must upgrade UFs after the Splunk Central infrastructure is updated because you must have on UFs the same or lower version of Splunk, not greater. Then you can upgrade all UFs also in one shot. You didn't anwered to the main question about this topic: have you deploymentclient.conf in $SPLUNK_HOME\etc\system\local or in a dedicated app? this is really important for the way (and the time) to change the new Deployment Server addressing. The all 62 Universal forwarders are in 9.0.1 version and out of 62 UF's 14 are windows servers and 48 are linux servers. My concern is with updating or modifying the deployment server details throughout all 62 universal forwarders, not with upgrading the Universal Forwarder itself. Instead of copying and pasting the add-on into each universal forwarder, is it feasible to make a new add-on and push it into all 62 of them at once? If yes, Could you please guide me the process of creating addon and how to apply that add-on on linux OS and windows OS. The deploymentclient.conf for the some servers is stored in \etc\system\local, and some servers are stored in dedicated apps. Thanks & Regards, Venkata Anuradha Neti. ... View more

Hi @gcusello  Greetings of the day. I would like to inform you that the downtime for this activity is consuming a lot of time which is an issue for us. Could you please clarify on the below points. 1) Can we move the backup from the old server to the new server in the pre-installation and then start the new Splunk version installation. 2) Is it possible to make changes to all 62 universal forwarders in a single shot prior to installing the latest Splunk version? Instead of copying and pasting the add-on into each universal forwarder.  If yes, Could you please let me know the process. ... View more

Hi @gcusello  Could you clear the doubts on the below points.  copy the $SPLUNK_HOME\etc folder on the new machines,   Should I copy the $SPLUNK_HOME\etc folder throughout all servers? ( Search Head, Indexers, Deployment Server). and is the single etc folder backup sufficient? Now, it's relevant if you configured deploymentclient.conf and outputs.conf on your forwarders in a dedicated App, managed by Deployment Server, or they are in $SPLUNK_HOME/etc/system/local. Sorry, I didn't get this point. Could you please explain in more detail And with version 9.0.1, we have 62 universal forwarders. Do we need to make any changes to these UFs before or after installing Splunk Enterprise 9.0.2 on the SearchHead, Indexers, and Deployment Servers? ... View more