I am getting to the point where I have quite a few Universal Forwarders in my Splunk infrastructure. I was wondering if there was a more simple way of installing/configuring the Universal Forwarders, specifically in inputs.conf. Every change I want to make I have to go through each machines' inputs.conf to alter it. As an infomercial might say, "There's got to be a better way!"
Any help appreciated.
You should try using a deployment server to push configuration changes to your Universal Forwarders. Try taking a look here: http://answers.splunk.com/answers/209735/which-inputsconf-do-i-edit-for-a-universal-forward.html
and here: http://docs.splunk.com/Documentation/Splunk/6.2.1/Updating/Aboutdeploymentserver
You should try using a deployment server to push configuration changes to your Universal Forwarders. Try taking a look here: http://answers.splunk.com/answers/209735/which-inputsconf-do-i-edit-for-a-universal-forward.html
and here: http://docs.splunk.com/Documentation/Splunk/6.2.1/Updating/Aboutdeploymentserver
I have a deployment server that I am already using to push apps, I am just unaware of how to push specific input.conf settings. Do I have to make my own "app", and push it?
Yes, you would have to make your own "app" and push it out to your Universal forwarders using deployment-apps.
http://docs.splunk.com/Documentation/Splunk/6.2.3/Updating/Createdeploymentapps