Hi there,
i followed the install [instructions](https://docs.splunk.com/Documentation/Splunk/7.0.3/Admin/Integrateauniversalforwarderontoasystemimage) for the installation of the splunk UF in our Citrix environment.
We used this command for the installation on the master.
`msiexec.exe /i splunkforwarder-7.0.3-fa31da744b51-x64-release.msi DEPLOYMENT_SERVER=":8089" AGREETOLICENSE=yes LAUNCHSPLUNK=0 /quiet`
The preperation of the master image works fine.
After we start the first provisioned server with this image, we saw that the UF communicates with the deployment server and received the prepared inputs.conf, outputs.conf. And a few minutes later we received some events from the event log on the indexer. So far everythings works as expected.
But if we restart the provisioned server, the image of the server will be reseted and therefore the previosly generated "GUID" of the server is gone. After the splunk UF service is started again, the service will generate a new guid.
On the splunk master server in the Forwarders:Deployment menu we see for each reboot a new entry of the UF for the provisioned server.
Is there a way to set to the provisioned servers always the same guid? Is it possible to deploy the instance.cfg by the deployment server?
Any help / info is welcome.
Thanks.
↧