topic Custom app creation | where to put inputs.conf and others? in Getting Data In

Custom app creation | where to put inputs.conf and others?

GaetanVP — Mon, 24 Oct 2022 13:23:25 GMT

Hello Splunkers,

I have a really quick question, I want to create and push (via my DS) a fully custom Add-On (or TA... not sure how to call it) to some of my UFs.

Basically I only need a inputs.conf to monitor some log files, but I do not know if I should place it under default/ or local/ folder.

I know that for Splunk based TA, I would have overwritten the defaults config file with my local config files, but for a custom app I don't really know.
Should I create inputs.conf inside default/ folder but with "disabled = true" for all stanza, and overwrite it with my local inputs.conf ?

Thanks for your help,
Gaetan

Re: Custom app creation | where to put inputs.conf and others

gcusello — Mon, 24 Oct 2022 06:54:16 GMT

Hi @GaetanVP,

as you well know, if you're speaking of a custom App, you can choose both the locations.

For a custom app I prefer to use default to avoid to maintain old configurations and having a better control on the deployed configuration.

About the name I prefer TA because is quicker.

About the last question, create in deault folder the inputs you need, if there are not requested inputs, I prefer to delete them or to comment them than to use disabled=true.

Ciao.

Giuseppe

Re: Custom app creation | where to put inputs.conf and others

isoutamo — Mon, 24 Oct 2022 07:07:24 GMT

as @gcusello said, basically you could put those which place you want. But as you are owner/developer of that TA then (according to instructions) you should use default folder for those. The only exceptions are if you have any plaintext password which needs to crypt when that TA is installed on UF, then you should put those under local to get those crypted. You should put only that plaintext password to local and all other values in that stanza to default.

r. Ismo

Re: Custom app creation | where to put inputs.conf and others

GaetanVP — Mon, 24 Oct 2022 07:13:27 GMT

Hello @gcusello,

Thanks for your quick and clear answer, I agree with all of your points 👍

Regards,
Gaetan