We have a master image controlling 10 Citrix XenApp hosts, We have deployed Splunk Universal Forwarders via master image, however, all the UF's are reporting with the same master image name. From configuration files,
$SPLUNK_HOME/etc/system/local/inputs.conf
[default]
host=
$SPLUNK_HOME/etc/system/local/server.conf
[general]
serverName=
If we fix these individually on the servers, that is updated...however, after rebooting the server, it downloads the master image then it all overwrites. Please advise on how to manage this scenario? Is there any way to update hostname while starting Splunk on the server?
↧