I am deploying Universal Forwarders by either Puppet or SCCM to multiple hosts. They will be forwarding to a 6.3.0 multisite indexer cluster.
Is there a way to set site=site0 in the system/local/server.conf to save having to log into each server to update this flag?
↧