Getting Data In

How does Splunk connect to the Universal forwarders — using IP or HostNames?

arrangineni
Path Finder

Can anyone clarify if Splunk Deployment server and Indexer connects to Universal forwarder using hostname or IP address. How can we find that?

0 Karma
1 Solution

sbattista09
Contributor

the UF will reach out to the deployment server with deploymentclient.conf
https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Deploymentclientconf

[deployment-client]
phoneHomeIntervalInSecs = 500
[target-broker:deploymentServer]
# Change the targetUri
targetUri = here it can be IP OR FQDN over what ever port you have set the default it 8089 i think.

The UF will send logs to indexers with outputs.conf
https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Outputsconf

[tcpout]
defaultGroup = splunkgroup

[tcpout:splunkgroup]
server= here it can be IP OR FQDN over what ever port you have set the default is 9997 indexer1.example.com:9997, indexer2.example.com:99978, indexer3.example.com:9997
autoLB = true
autoLBFrequency = 7
forceTimebasedAutoLB = true

View solution in original post

sbattista09
Contributor

the UF will reach out to the deployment server with deploymentclient.conf
https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Deploymentclientconf

[deployment-client]
phoneHomeIntervalInSecs = 500
[target-broker:deploymentServer]
# Change the targetUri
targetUri = here it can be IP OR FQDN over what ever port you have set the default it 8089 i think.

The UF will send logs to indexers with outputs.conf
https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Outputsconf

[tcpout]
defaultGroup = splunkgroup

[tcpout:splunkgroup]
server= here it can be IP OR FQDN over what ever port you have set the default is 9997 indexer1.example.com:9997, indexer2.example.com:99978, indexer3.example.com:9997
autoLB = true
autoLBFrequency = 7
forceTimebasedAutoLB = true

arrangineni
Path Finder

Thanks for the clarification.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...