Is there an easy way to redirect existing universal forwarders to a new Splunk deployment?

[phillipmadm]

We are migrating datacenters and the current virtual deployment server has been replicated to the new facility. I can bring it up, change the IP and hostname but is there a central way to redirect existing universal forwards to the newly IP'ed deployment server? Most suggestions I've seen online are outdated and end up saying do it manually anyway.

[phillipmadm]

I wish but the Network guys would go nuts. New physical datacenter with a separate IP range.

[gcusello · Accepted solution]

Hi phillipmadm,
the easiest way is to run a remote script or use a software distribution system.
I read that it's possible to use the old Deployment Server But I didn't tryed because deploymentclient.conf is usually located in %SPLUNK_HOME/system/local and a script it's easier.
Bye.
Giuseppe

[ddrillic]

Absolutely - this is quite a big challenge to update all the deploymentclient.conf on all the forwarders. A remote script which iterates through all the forwarders is what we do. Now, if some of the forwarders are on Windows and some on Linux, AIX, Solaris, the script needs to be pretty evolved...

[phillipmadm]

Our environment is Windows, RedHat and Solaris so not the easy solution I was looking for.
:)

[gcusello]

Could you use the old DS ip address on the new one?
In this way you solve your problems
Bye.
Giuseppe

[ddrillic]

@phillipmadm, look, you need this type of scripts anyway...

[gcusello]

If this answer satisfies your question, please accept or upvote it.
Bye.
Giuseppe

[gcusello]

Yes it needs!
infact we used two different scripts for Linux and AIX (only just a little different, in connection!), but it's a very simple script because you have to perform only three actions:

• connect to the remote server,
• copy the new deploymentclient.conf in $SPLUNK_HOME/etc/system/local,
• run $SPLUNK_HOME/bin/splunk restart

So it's very quick to create and run these three scripts.

Check if you have something like LanDesk to deploy deploymentclient.conf to Windows servers.

Bye.
Giuseppe

[rphillips_splk]

If you are managing the forwarders with a deployment server you could update outputs.conf via an app to change the indexers you are forwarding to.

https://docs.splunk.com/Documentation/MSApp/1.4.2/MSInfra/Setupadeploymentserver

[phillipmadm]

We are currently using a deployment server that is replicated to a new datacenter. We can standup the replicated server with a unique address but I do not see in the referenced link where we can point existing machines to the IP. A script to update the deploymentclient.conf is valid but writing one that parses out the various operating systems in our environment is challenging with the current staffing levels. Manual seems to be the way to go.