Managing Splunk LF with Deployment Server

balbano — Tue, 18 May 2010 03:58:50 GMT

Hey guys,

I managed to setup deployment server / client test model with our 2 central indexers and a test sample of servers. I realize that the test servers phone home to the deployment server in intervals and pull any new dafault config changes. However, we do not necessarily have a standardization with logging. Some servers store logs one place... some servers could store logs in another place. Can we still manually configure inputs.conf in $Splunk_Home/etc/system/local on the forwarders to overwrite the default configurations being pulled?

Any help you can provide would be great. Thanks.

Brian A

Re: Managing Splunk LF with Deployment Server

piebob — Tue, 18 May 2010 04:17:14 GMT

yes, the forwarders will use the same logic (described here: http://www.splunk.com/base/Documentation/latest/Admin/Wheretofindtheconfigurationfiles ) to read their configuration files as a standard Splunk deployment does.

topic Managing Splunk LF with Deployment Server in Deployment Architecture

Managing Splunk LF with Deployment Server

Re: Managing Splunk LF with Deployment Server