topic Re: deployment server not updating inputs.conf on clients in Getting Data In

deployment server not updating inputs.conf on clients

pc1 — Wed, 17 Nov 2021 19:43:38 GMT

When pushing the Windows add on for Splunk using a deployment server, my inputs.conf files on the clients are not updating. The clients are regularly checking in with the deployment server, and splunk has been restarted on both deployment and client servers several times. This is creating an issue because updates to inputs.conf stored in the local folder are not being updated across my clients. If anyone has any further troubleshooting ideas to get the clients to fluently sync up to the proper inputs.conf from the deployment server please let me know.

If it matters - The specific changes (simply enabling them by changing disabled=1 to 0) were made to the scripted inputs below. The timestamp on inputs.conf on the client is much older than the changes and still left at disabled=1.

###### Scripted Input (See also wmi.conf)
[script://.\bin\win_listening_ports.bat]
disabled = 0
## Run once per hour
interval = 3600
sourcetype = Script:ListeningPorts

[script://.\bin\win_installed_apps.bat]
disabled = 0
## Run once per day
interval = 86400

Re: deployment server not updating inputs.conf on clients

PickleRick — Wed, 17 Nov 2021 20:19:32 GMT

Did you by any chance did initial installation/configuration by hand? And now are files owned by another user so that UF cannot overwrite them?

Re: deployment server not updating inputs.conf on clients

pc1 — Wed, 17 Nov 2021 20:30:11 GMT

I think so, if installing the universal forwarder and pointing it towards the deployment server and main enterprise instance is what you mean. The files are owned by my account on the clients. Is there a way to have used my splunk deployment server to say go find these servers and install the universal forwarder?

Should I edit the permissions on the client's files to give permission to something else? Not sure how to link to to the deployment server as that is a server, and not a user account. Both are windows environment.

Re: deployment server not updating inputs.conf on clients

PickleRick — Wed, 17 Nov 2021 20:35:24 GMT

Sorry, I might not have been clear enough. I didn't mean the initial UF installation but the windows TA installation. If it was unpacked and placed into the apps directory so that the user the UF runs with (by default it's Local System under Windows) is not able to overwrite, it can't be "overdistributed".

Check what user the splunk forwarder service runs with (again - by default it's Local System) and check if this user has write permissions to app files. If not, adjust permissions.

Re: deployment server not updating inputs.conf on clients

pc1 — Wed, 17 Nov 2021 20:40:49 GMT

Ah, then yes the Windows add on was originally deployed through my deployment server. No manually installation of apps was done - only on the deploy server when I originally set it up to go out. On my clients it does indeed have System with full control for all of the Universal Forwarder.

Re: deployment server not updating inputs.conf on clients

akashsawant — Fri, 01 Sep 2023 20:07:50 GMT

@pc1 Can you please advise the solution if you manage to resolve this issue. Thanks!