topic Re: Issue with configuring forwarder in Getting Data In

Issue with configuring forwarder

rameshlpatel — Thu, 28 Nov 2013 20:35:13 GMT

Hi,

I had configured my universal forwarder on production by adding conf files ie. inputs.conf,outputs.conf and deploymentclient.conf in etc/system/local folder.

Now I want to make changes( like monitoring path etc) on conf files through deployment server by using deployment-app.

I tried this scenario in my local but it not overriding my existing configuration and more its monitoring older path as well as newer path. Might it was not orderride but it is merged.

Please suggest me any solution.

Re: Issue with configuring forwarder

Ayn — Thu, 28 Nov 2013 20:49:41 GMT

How is this different from http://answers.splunk.com/answers/112956/deployment-server-to-forwarder-communication ?

Re: Issue with configuring forwarder

rameshlpatel — Thu, 28 Nov 2013 20:58:10 GMT

It not mach different but now i am facing this issue for all conf files.

Please suggest me resolution or best practice

Re: Issue with configuring forwarder

yannK — Mon, 28 Sep 2020 15:23:12 GMT

The apps created in the folder $SPLUNK_HOME/etc/deployment-apps on the deployment server, and defined in the serverclass.conf (or in the forwarder manager page) will be deployed to the deployment-clients in $SPLUNK_HOME/etc/apps.
Therefore they will never replace the configs from $SPLUNK_HOME/etc/system/local.

For details about the deployment server, follow the docs
http://docs.splunk.com/Documentation/Splunk/latest/Updating/Aboutdeploymentserver

Check if the apps have been deployed, If you are not sure of the precedence between the configurations, use the btool command to check the result.
precedence rules :
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Wheretofindtheconfigurationfiles
btool
http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Usebtooltotroubleshootconfigurations

Re: Issue with configuring forwarder

rameshlpatel — Fri, 29 Nov 2013 19:53:18 GMT

Thanks for answer.

If we need option of updating confs files from deployment server then we didnot need to add this files in system/local folder. right ?

Or Is there any way to override system/local files from deployment server then please let me know

Re: Issue with configuring forwarder

lukejadamec — Sat, 30 Nov 2013 05:15:48 GMT

When it comes to directory monitoring behavior, you cannot override the system\local folder - it has the highest priority - see the link YannK posted.
Correct, if you want to have something controlled by a deployment server, then you should not have placed the configuration in system\local.