topic Need help modifying inputs.conf on several clients in Getting Data In

Need help modifying inputs.conf on several clients

tam82 — Wed, 26 Jan 2022 22:45:37 GMT

how can I pull and modify the inputs.conf file on over 2000+ universal forwarders?

Can I do this by running a script that I create in an app and deploy through Deployment server?

Re: Need help modifying inputs.conf on several clients

gcusello — Thu, 27 Jan 2022 07:19:39 GMT

Hi @tam82,

there's something that I don't understand:

you have an active Deployment Server, is it correct?

why don't you use it to deploy inputs.conf file in an app to all the Forwarders?

It's it's own role!

Could you better describe your need?

Ciao.

Giuseppe

Re: Need help modifying inputs.conf on several clients

tam82 — Thu, 27 Jan 2022 14:07:04 GMT

I thought there were settings you could only set in the /system/local area. like the base output file

Re: Need help modifying inputs.conf on several clients

gcusello — Thu, 27 Jan 2022 14:51:10 GMT

Hi @tam82,

putting configurations in system/local is a solution for a lab because it's quick but not useful in a production environment because configuration in system/local cannot be automatically updated by the DS.

So it's better to put all the configuration files (also outputs.conf and deploymentclient.conf) in a dedicated Add-On (called e.g. TA_Forwarders) to deploy using the Deployment Server in all client.

If you already have in your installation some configuration file in system/local, you have to do the following steps:

create a new TA containing at least outputs.conf and deploymentclient.conf and all the configuration files you need (not server.conf!),
deploy it on all your clients using DS,
remove configuration files from system/local using a script.

Ciao.

Giuseppe

Re: Need help modifying inputs.conf on several clients

SinghK — Thu, 27 Jan 2022 14:56:54 GMT

There must be an app on your DS which has those inputs. modify the inputs and redeploy using

$Splunk_Home/bin/splunk reload deploy-server. or let the forwarders sync with DS and get the new copy of app.

Re: Need help modifying inputs.conf on several clients

tam82 — Thu, 27 Jan 2022 15:00:38 GMT

Thank you

Re: Need help modifying inputs.conf on several clients

gcusello — Thu, 27 Jan 2022 15:02:59 GMT

Hi @tam82,

tell me if you need more infos or if the answer solves your question, in this case, please, accept it for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

Re: Need help modifying inputs.conf on several clients

tam82 — Thu, 27 Jan 2022 16:10:39 GMT

How do you create the add-on, and if you have not deployed the deploymentclient.conf on install how does the UF know about the deployment server

Re: Need help modifying inputs.conf on several clients

gcusello — Thu, 27 Jan 2022 16:30:16 GMT

Hi @tam82,

I created an app called TA_:Forwarder with the usual structure of each Splunk app (folders: bin, Default, local and metadata).

Then in the default folder I added two files: outputs.conf and deploymentclient.conf.

If you want, you can also use the Splunk Add-On Builder App (https://splunkbase.splunk.com/app/2962/) that's very useful.

About the first installation I teached the customer specialists to copy the TA_Forwarder in $SPLUNK_HOME/apps on a machine and restart Splunk, in this way the client is connected with the Deployment Server

Remember, before everything, to create a ServerClass containing all the clients to deploy the TA_Forwarder App, otherwise, at the first connection, the manually copied app id deleted by the DS.

If you already have deploymentclient.conf and outputs.conf in system/local, you have to run a script to delete these files and restart Splunk after TA_Forwarders deployment.

Ciao.

Giuseppe