Hi All,
We are deploying out the Splunk Universal Forwarder at the moment which is going well but I'm looking at getting this installed on our Citrix Infrastructure.
In our environment, we have "Golden Images" where we make changes. Once published (Using PVS), the new image will be deployed out to the Citrix servers in that specific delivery group. When the server/s (None-Persistent) in that group performs their reboots which is nightly they pick up the golden image via PVS.
Using the clone prep command works and the new client comes through in the Forwarder Management without any issues which I'm happy with as it is working as expected but as these servers reboot every night, I'm finding that duplicate entries of the same servers are being created when the reboot completes and Splunk connects to the deployment server.
I'm presuming that this is because the GUID is changing every time these servers reboot in the night but I want to know if there is a way to ensure it uses the same GUID for that hostname so that it avoids creating duplicate records in the Forwarder Management console? Or if there is some option somewhere where Splunk identifies a duplicate hostname and removes it automatically?
For example, this is how it works:
SERVERMAIN01 - Citrix Maintenance Server where golden images are attached and changes can be made.
SERVERAPP01 - Application server which picks up golden image (None-Persistent) and is rebooted nightly
SERVERAPP02 - Application server which picks up golden image (None-Persistent) and is rebooted nightly
SERVERAPP03 - Application server which picks up golden image (None-Persistent) and is rebooted nightly
So essentially, I'm getting duplicate clients in the Forwarder Management for SERVERAPP01/02/03 every night which will just build up over time unless I manually intervene which takes up my time.
Hope this all makes sense and someone can point me in the right direction as I've searched around for a while and can't find any posts around this.
Cheers,
