How does Splunk connect to the Universal forwarders — using IP or HostNames?

[arrangineni]

Can anyone clarify if Splunk Deployment server and Indexer connects to Universal forwarder using hostname or IP address. How can we find that?

[sbattista09 · Accepted solution]

the UF will reach out to the deployment server with deploymentclient.conf
https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Deploymentclientconf

[deployment-client]
phoneHomeIntervalInSecs = 500
[target-broker:deploymentServer]
# Change the targetUri
targetUri = here it can be IP OR FQDN over what ever port you have set the default it 8089 i think.

The UF will send logs to indexers with outputs.conf
https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Outputsconf

[tcpout]
defaultGroup = splunkgroup

[tcpout:splunkgroup]
server= here it can be IP OR FQDN over what ever port you have set the default is 9997 indexer1.example.com:9997, indexer2.example.com:99978, indexer3.example.com:9997
autoLB = true
autoLBFrequency = 7
forceTimebasedAutoLB = true

[arrangineni]

Thanks for the clarification.