https://community.splunk.com/t5/Getting-Data-In/How-to-distribute-the-configuration-bundle-of-inputs-conf-to-an/m-p/178575#M35810 <P>Helped me too. Thanks!</P> Mon, 07 Sep 2015 16:02:20 GMT napomokoetle 2015-09-07T16:02:20Z https://community.splunk.com/t5/Getting-Data-In/How-to-distribute-the-configuration-bundle-of-inputs-conf-to-an/m-p/178572#M35807 <PRE><CODE>[default] host = cmgr1.splunk.hq1.xxx.com [splunktcp://9997] connection_host = ip </CODE></PRE> <P>I'm trying to deploy a very simple inputs.conf via the Distribution Configuration Bundle. I was able to deploy my indexes.conf file, and the process was pretty simple.</P> <P>However, when I try to deploy the above, it does NOT work.</P> <P>Question:<BR /> I do not understand how the part will propagate. Will it know how to change that host to what the host actually is? I have 5 indexers with different host names. Will it change them to the proper host name for each?</P> <PRE><CODE>[default] host = cmgr1.splunk.hq1.xxx.com </CODE></PRE> <P>Am I doing this right? Is there a better / proper way to deploy the inputs.conf across my indexers so as to receive logs?</P> Thu, 25 Jun 2015 17:34:44 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-distribute-the-configuration-bundle-of-inputs-conf-to-an/m-p/178572#M35807 shandman 2015-06-25T17:34:44Z https://community.splunk.com/t5/Getting-Data-In/How-to-distribute-the-configuration-bundle-of-inputs-conf-to-an/m-p/178573#M35808 <P>Actually the inputs.conf you want to distribute is just: </P> <PRE><CODE> [splunktcp://9997] connection_host = ip </CODE></PRE> <P>When you install and accept the license to Splunk on each of your cluster-slaves / indexers, it'll setup an SPLUNK_HOME/etc/system/local/inputs.conf that defines:</P> <PRE><CODE>[default] host = (hostname) </CODE></PRE> <P>So when Splunk puts the configuration together <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/Admin/Wheretofindtheconfigurationfiles">according to the precedence rules</A>, it'll get the splunktcp stanza that you push from the cluster master, and the default host from the system/local copy on each indexer.</P> Thu, 25 Jun 2015 18:17:49 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-distribute-the-configuration-bundle-of-inputs-conf-to-an/m-p/178573#M35808 acharlieh 2015-06-25T18:17:49Z https://community.splunk.com/t5/Getting-Data-In/How-to-distribute-the-configuration-bundle-of-inputs-conf-to-an/m-p/178574#M35809 <P>This worked perfect! Thank you!!</P> Thu, 25 Jun 2015 18:35:45 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-distribute-the-configuration-bundle-of-inputs-conf-to-an/m-p/178574#M35809 shandman 2015-06-25T18:35:45Z https://community.splunk.com/t5/Getting-Data-In/How-to-distribute-the-configuration-bundle-of-inputs-conf-to-an/m-p/178575#M35810 <P>Helped me too. Thanks!</P> Mon, 07 Sep 2015 16:02:20 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-distribute-the-configuration-bundle-of-inputs-conf-to-an/m-p/178575#M35810 napomokoetle 2015-09-07T16:02:20Z