Deployment Architecture

Change server.conf script

markrponce
New Member

I need to add configuration changes to the server.conf file on 800+ systems. I know how to add changes to the server.conf however I'm trying to avoid fixing each box individually. Is there any automated why to do this? Thanks!

Tags (1)
0 Karma

maniishpawar
Path Finder

As suggested above, SCCM for windows is perfect for this kind of job.
If it is not available, use powershell script or powershell DSC scripts which can automate this stuff.

Still another solution, which I am not sure is a valid approach , try to check with your n/w admins, I guess files can be pushed using group policy as well.

0 Karma

jrprez1804
Path Finder

You can use tools like PDQ deploy for a windows environment to help automate this kind of task.

0 Karma

rturk
Builder

Hi Mark,

I don't think there's a quick & easy fix for you I'm afraid. By default server.conf is located here:

$SPLUNK_HOME/etc/system/local/server.conf

Because it's here, it has the highest precedence and will overwrite identical config stanzas declared in a server.conf you put in any user or app directories. So that kinda rules out using a deployment server.

If you're using Linux, then you might want to consider using something like Puppet, or Chef for config file management which would make this a relatively simple task... but seeing as you're asking this questions I'm guessing you don't have it, and because you have 800+ server it will be a non-trivial task/project to undertake.

If you're using Windows, then something like SCCM will be your best bet... but once again, if you don't have it... then expect it to be a non-trivial task/project to undertake.

My advice... if it's a Linux environment you have, make friends with one of your Admins who knows a bit about scripting.

Good Luck!

markrponce
New Member

Thanks for the answer! I was hoping someone else had this same problem and had found a automated way to fix it.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...