Deployment Architecture

Changing address of indexers for universal forwarders altogether

sh_tavousi
Explorer

Hi,

I want to know how we can change address of indexers for universal forwarders from deployment server as we have many UFs. Is there any way to change inputs.conf  of UFs instead of changing one by one.

Thanks,

Shohre

Labels (3)
Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

If I understand right you want to change UF's target server addresses on outputs.confs?

You should just create/update your UFs' app where you have all needed information to connect to your splunk indexers? I suppose that you have this kind of app in use instead of hard coded those under .../system/local/outputs.conf? If you haven't it then you should create one and migrate all your UFs to use it.

If you have indexer cluster in use then you you should use indexer discovery to manage these connections automatically.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...