topic Re: Deployment Server and Universal Forwarder in Getting Data In

Deployment Server and Universal Forwarder- Which file is being monitored?

phularah — Fri, 09 Sep 2022 07:57:20 GMT

I saw a question on the internet while searching for answers for a separate question and a few comments below regarding the correct answer for that. Now, I am confused as to what should have been the correct answer. This was the question.

This file has been manually created on a universal forwarder:

/opt/splunkforwarder/etc/apps/my_TA/local/inputs.conf
[monitor:///var/log/messages]
sourcetype=syslog
index=syslog

A new Splunk admin comes in and connects the universal forwarders to a deployment server and deploys the same app with a new inputs.conf file:

/opt/splunk/etc/deployment-apps/my_TA/local/inputs.conf
[monitor:///var/log/maillog]
sourcetype=maillog
index=syslog

Which file is now monitored?
/var/log/maillog or both /var/log/maillog and /var/log/messages

Re: Deployment Server and Universal Forwarder

gcusello — Fri, 09 Sep 2022 07:05:05 GMT

Hi @phularah,

when you connect a client to a Deployment Server, all the local apps will be removed and the apps for the ServerClass containing that client will be deployed.

So if the local inputs.conf is in an app (as it seems from your information), it will be removed.

If you want to monitor both the folders, you have to insert the local stanza in the deployed app.

Ciao.

Giuseppe

Re: Deployment Server and Universal Forwarder

isoutamo — Fri, 09 Sep 2022 08:45:58 GMT

it's just like @gcusello said. When the app name is same (installed into same path) then DS win. You could also check it with btool on UF side. Just

splunk btool inputs list monitor:///var/log --debug

and then look the output which shows all monitored files under /var/log

r. Ismo