topic Re: distribute outputs.conf to forwarders using deployment server??? in Deployment Architecture

distribute outputs.conf to forwarders using deployment server???

AzmathShaik — Thu, 21 Jul 2016 15:14:42 GMT

Hello,

i need to distribute outputs.conf file to my forwarder using deployment server.
i have set up deployment server and pointed the deployment clients. am able distribute apps to all my forwarders using deployment server. i need to distribute outputs.conf. do i need to do it in the same as i did to distribute apps or do i need to follow other way??

can any one help me in doing so???

Re: distribute outputs.conf to forwarders using deployment server???

somesoni2 — Thu, 21 Jul 2016 17:01:24 GMT

You would create (recommended) separate app for outputs.conf and will distribute in the same way you distribute any other app. Do remember to set restartSplunkd=true for the serverclass containing this app.

Re: distribute outputs.conf to forwarders using deployment server???

ddrillic — Thu, 21 Jul 2016 17:20:06 GMT

*outputs.conf * is an interesting artifact as it's normally being shared by many apps.

yannK has an interesting idea at -

Changing UF outputs.conf using deployment server

• create an app in the deployment server in .../etc//deployment-apps//default/outputs.conf

• define a serverclass.conf on the deployment server (to match clients to apps)

• configure the forwarders to point to the deployment-server in deploymentclient.conf

Meaning, the idea of creating a global *outputs.conf *.

Re: distribute outputs.conf to forwarders using deployment server???

gendalia — Tue, 29 Sep 2020 10:24:50 GMT

An app is a set of configuration files in this case.

On my deployment server, I created ${SPLUNK_HOME}/etc/deployment-apps/01_ISU_A_Indexers (I use numbers for ASCII ordering of apps, ISU for locally created apps, and I have two sets of indexers, so two apps, one for each set).

In ${SPLUNK_HOME}/etc/deployment-apps/01_ISU_A_Indexers/local I put outputs.conf. A reload of deployment sever is probably necessary, so "splunk reload deploy-server". Then the app is available to be pushed out via server classes.