topic Re: Best way to change the inputs.conf file of a universal forwarder from deployment server. in Getting Data In

Best way to change the inputs.conf file of a universal forwarder from deployment server.

ssankeneni — Tue, 09 Oct 2012 18:27:15 GMT

Can any one please let me know the best way to update the opt/splunkforwarder/etc/system/local/inputs.conf of universal forwarder from a deployment server. I'm able to achieve this by creating an app called local in deployment server but Is there any better way to do this ?

Re: Best way to change the inputs.conf file of a universal forwarder from deployment server.

bmacias84 — Tue, 09 Oct 2012 19:45:09 GMT

Have you configured your Deployment server? Is your UF configured to contact said Deployment Server?

Re: Best way to change the inputs.conf file of a universal forwarder from deployment server.

ssankeneni — Tue, 09 Oct 2012 19:48:09 GMT

Yes, but the issue is I do have a serverclass.conf file that is set to deploy in to opt/splunkforwarder/etc/system/local directory instead of apps.

Re: Best way to change the inputs.conf file of a universal forwarder from deployment server.

ssankeneni — Tue, 09 Oct 2012 19:48:32 GMT

I'm looking for a way to deploy it as an app itself

Re: Best way to change the inputs.conf file of a universal forwarder from deployment server.

bmacias84 — Tue, 09 Oct 2012 20:05:42 GMT

Give me a moment and I'll have a sample config.

Re: Best way to change the inputs.conf file of a universal forwarder from deployment server.

bmacias84 — Tue, 09 Oct 2012 20:27:59 GMT

If you have configured your Deployment Server correctly and you have an app called myfirstapp.
Here is a sample serverclass.conf:

Defaults for app repository on Deployment server: $SPLUNK_HOME\etc\deployment-apps

Default for install location on client server: $SPLUNK_HOME\etc\apps



#serverclass.conf

#default deployment server settings

[global]

repositoryLocation=$SPLUNK/etc/deployment-apps #repository of your apps you wish to deploy

restartSplunkd=false

restartSplunkWeb=false

stateOnClient=disabled #all apps are disable unless stated at higher precede stanza

blacklist.0=*  # all server are blacklisted unless stated at higher precede stanza

continueMatching=true 

#my forwarders class.  This class will deploy all apps under this calss to any server in 10.1.251.* range

[serverClass:forwarders]

restartSplunkd=true #restart Splunkd after install

stateOnClient=enabled

whitelist.0=10.1.251.* #Range of Forwarders

#deploy myfirstapp using serverClass fowarders

#location of my firstapp: $SPLUNK_HOME\etc\deployment-apps\firstapp

[serverClass:forwarders:app:myfirstapp]

On your forwarder if not configured:



#deploymentclient.conf

[deployment-client]

Disabled=false

phoneHomeIntervalInSecs = 300

[target-broker:deploymentServer]

targetUri=:8089

To list deployment clients use: splunk list deploy-clients

Additional reading:

http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/ConfigureDeploymentClients

http://docs.splunk.com/Documentation/Splunk/5.0/Admin/Serverclassconf

http://wiki.splunk.com/Deploy:DeploymentServer

Hope this helps.