Deployment Architecture

Managing Universal Forwarders and Indexers hosts

imosquera
Explorer

What is the best way to manage universal forwarders and indexers at scale?

By this I mean, If I have 10 indexers today, I specify those on the universal forwarders configuration (outputs.conf). If I add 3 new indexers will have to update every universal forwarder in my site?

This could be upwards to 200 machines running the universal forwarders that would need an update. I've read a few times that using a loadbalancer is not a good solution to reduce the overhead of managing the indexers list.

What is the best way to manage the indexers list and configuration on the forwarders?

0 Karma

srioux
Communicator

Probably best to use a Deployment Server to manage outputs.conf across all your indexers. Just build it as part of a deployed app.

Lots of documentation on using a deployment server:

[http://docs.splunk.com/Documentation/Splunk/5.0.3/Deploy/Aboutdeploymentserver][1]

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...