Getting Data In

After deploying universal forwarders on Citrix hosts via master image, how to prevent all UF's from reporting the same hostname?

anushareddy6767
Explorer

We have a master image controlling 10 Citrix XenApp hosts, We have deployed Splunk Universal Forwarders via master image, however, all the UF's are reporting with the same master image name. From configuration files,

$SPLUNK_HOME/etc/system/local/inputs.conf

[default]
host=<master image Name>

$SPLUNK_HOME/etc/system/local/server.conf

[general]
serverName=<master image name>

If we fix these individually on the servers, that is updated...however, after rebooting the server, it downloads the master image then it all overwrites. Please advise on how to manage this scenario? Is there any way to update hostname while starting Splunk on the server?

0 Karma

bsonposh
Communicator

The only solution I found for this was to set the UF service to manual and have a script that sets the CONF files correctly and starts the service. This has to be in the base image.

Another option is to install via GPO and use deployment server for the config.

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...