I am deploying Universal Forwarders by either Puppet of SCCM to multiple hosts. They will be forwarding to a 6.3.0 multisite index cluster.
Is there a way to set site=site0 in the system/local/server.conf to save having to log into each server to update this flag?
↧