Getting Data In

After deploying universal forwarders on Citrix hosts via master image, how to prevent all UF's from reporting the same hostname?

anushareddy6767
Explorer

We have a master image controlling 10 Citrix XenApp hosts, We have deployed Splunk Universal Forwarders via master image, however, all the UF's are reporting with the same master image name. From configuration files,

$SPLUNK_HOME/etc/system/local/inputs.conf

[default]
host=<master image Name>

$SPLUNK_HOME/etc/system/local/server.conf

[general]
serverName=<master image name>

If we fix these individually on the servers, that is updated...however, after rebooting the server, it downloads the master image then it all overwrites. Please advise on how to manage this scenario? Is there any way to update hostname while starting Splunk on the server?

0 Karma

bsonposh
Communicator

The only solution I found for this was to set the UF service to manual and have a script that sets the CONF files correctly and starts the service. This has to be in the base image.

Another option is to install via GPO and use deployment server for the config.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...