Getting Data In

After deploying universal forwarders on Citrix hosts via master image, how to prevent all UF's from reporting the same hostname?

anushareddy6767
Explorer

We have a master image controlling 10 Citrix XenApp hosts, We have deployed Splunk Universal Forwarders via master image, however, all the UF's are reporting with the same master image name. From configuration files,

$SPLUNK_HOME/etc/system/local/inputs.conf

[default]
host=<master image Name>

$SPLUNK_HOME/etc/system/local/server.conf

[general]
serverName=<master image name>

If we fix these individually on the servers, that is updated...however, after rebooting the server, it downloads the master image then it all overwrites. Please advise on how to manage this scenario? Is there any way to update hostname while starting Splunk on the server?

0 Karma

bsonposh
Communicator

The only solution I found for this was to set the UF service to manual and have a script that sets the CONF files correctly and starts the service. This has to be in the base image.

Another option is to install via GPO and use deployment server for the config.

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...