Hi @danielleedgington92,
in addition to all the hints of @richgalloway , I suggest to create a Technical Add-on (called e.f. TA_Forwarders): it's an app containing only two files:
deploymentclient.conf
outputs.conf
The first one contains the address of the Deployment Server (remember that if you have to manage more than 50 target servers you must have a dedicated server for this role!).
The second one contains the addresses of the indexers.
In this way you can manage all the configurations by Deployment Server.
The problem is how to rich the Deployment Server for the first time: for this reason, I usually copy this app (TA_Forwarders) on each target server (and I restart Splunk on UF), so it's connected with the Deployment Server and I can deploy to all the UFs the TAs I need.
Ciao.
Giuseppe
... View more