Nearly 30+ application servers are configured into the splunk environment (30 forwarders,2 Indexers (one indexer as deployment server also a search head) , with all their SSL certificates enabled between them
My question is if we want to add 2 more application server logs to an already existing splunk environment ,
1.what are the steps we need to follow ?
2.manly what about the SSL certificate ?
3. Is it TURE that is it possible to start the UF by making the appropriate configurations in it when it connects to indexer it will automatically inherit the SSL configurations ?
Thank you very much @renjith.nair ...
1.In order to send the cofigurations via deployment server , I need to touch the splunk main server and follow http://docs.splunk.com/Documentation/Splunk/7.1.2/Updating/Createdeploymentapps
2.If the log files residing location is not going to change for long time is it best practice to keep the inputs and outputs conf files in UF (where as all the current 30 application servers are configured via deployment server only )