Can anyone clarify if Splunk Deployment server and Indexer connects to Universal forwarder using hostname or IP address. How can we find that?
the UF will reach out to the deployment server with deploymentclient.conf
https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Deploymentclientconf
[deployment-client]
phoneHomeIntervalInSecs = 500
[target-broker:deploymentServer]
# Change the targetUri
targetUri = here it can be IP OR FQDN over what ever port you have set the default it 8089 i think.
The UF will send logs to indexers with outputs.conf
https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Outputsconf
[tcpout]
defaultGroup = splunkgroup
[tcpout:splunkgroup]
server= here it can be IP OR FQDN over what ever port you have set the default is 9997 indexer1.example.com:9997, indexer2.example.com:99978, indexer3.example.com:9997
autoLB = true
autoLBFrequency = 7
forceTimebasedAutoLB = true
the UF will reach out to the deployment server with deploymentclient.conf
https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Deploymentclientconf
[deployment-client]
phoneHomeIntervalInSecs = 500
[target-broker:deploymentServer]
# Change the targetUri
targetUri = here it can be IP OR FQDN over what ever port you have set the default it 8089 i think.
The UF will send logs to indexers with outputs.conf
https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Outputsconf
[tcpout]
defaultGroup = splunkgroup
[tcpout:splunkgroup]
server= here it can be IP OR FQDN over what ever port you have set the default is 9997 indexer1.example.com:9997, indexer2.example.com:99978, indexer3.example.com:9997
autoLB = true
autoLBFrequency = 7
forceTimebasedAutoLB = true
Thanks for the clarification.