Getting Data In

What script should I use to upgrade multiple universal forwarders on Linux?

rgadepal
New Member

Hi,

I am looking to upgrade multiple universal forwarders installed on Linux OS at one go.
Could you please help me with the script I should use and the detailed steps on how to use that script?

Note: I have a standalone Splunk indexer.

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rgadepal,
as you can see in the Splunk ideas, there's in analysis the possibility to add this feature to Deployment Server, but at the moment the esiest way is to use a tool (third-party management tool like Ansible, Puppet, etc.) otherwise you can use a script that installs one Universal Forwarder at a time, if you want to parallelize UFs installation you can run it more times:

Script

 #!/bin/sh
 # Script to remotely install Splunk forwarder

 # to avoid to store readable password
 read -s -p "Enter Splunk Admin Password: " PASSWORD
 echo 

 # Configuration file
 source /home/your_user/config.ini

 # Command lists to execute in remote forwarder server
 REMOTESCRIPT="
 cd $DIRDEST
 $WGETCMD
 sudo tar -xzf $FWDTGZ
 sudo chown -R splunk:splunk $DIRDEST/splunkforwarder
 sudo -H -u splunk $DIRDEST/splunkforwarder/bin/splunk start --accept-license --answer-yes --auto-ports --no-prompt
 sudo $DIRDEST/splunkforwarder/bin/splunk edit user admin -password $PASSWORD -auth admin:changeme
 sudo $DIRDEST/splunkforwarder/bin/splunk set deploy-poll \"$DEPLOYSERVER\" -auth admin:$PASSWORD
 sudo $DIRDEST/splunkforwarder/bin/splunk enable boot-start -user splunk
 sudo chown -R splunk:splunk $DIRDEST/splunkforwarder
 sudo -H -u splunk $DIRDEST/splunkforwarder/bin/splunk restart
 "

 # Installation execution
 echo "============================= FORWARDER REMOTE INSTALLER ============================="
 echo
 sleep 5
 echo "Reading host logins from $TARGETSFILE"
 echo 
 echo "Start Forwarder remote installation to:"

 # hosts cycle
 for DEST in `cat "$TARGETSFILE"`; do

     if [ -z "$DEST" ]; then
         continue;
     fi
     echo 
     echo "- $DEST"
     ssh "$DEST" "$REMOTESCRIPT"

 done

Config.ini

 TARGETSFILE="/home/my_user/targets.ini"
 DIRDEST="/opt"
 WGETCMD="sudo wget -O splunkforwarder-your_version.tgz 'your_link"
 FWDTGZ="/opt/splunkforwarder-your_version.tgz"
 DEPLOYSERVER="your_Deployment_Server:8089"

Adapt the script to your needs.
In addition you could insert your host list in another file and read them from it.
Another hint is to copy in $SPLUNK_HOME/etc/apps a Technical Add-on in which there are two files: outputs.conf and deploymentclient.conf, in this way your Forwarders will connect directly to you Deployment Server and you can manage them

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...