topic Re: Deploy $SPLUNK_HOME/etc/log.cfg via deployment server? in Getting Data In

Deploy $SPLUNK_HOME/etc/log.cfg via deployment server?

ftk — Thu, 27 Jan 2011 05:21:04 GMT

Is it possible to deploy $SPLUNK_HOME/etc/log.cfg via the deployment server to my forwarders? I wish to reduce the footprint of my Lightweight Forwarders by reducing the log sizes as mentioned here: http://www.splunk.com/wiki/Community:MinimizingForwarderFootprint

I am currently handling this at initial Splunk installation time, however would prefer to offload this on to the Splunk deployment server.

Re: Deploy $SPLUNK_HOME/etc/log.cfg via deployment server?

jrodman — Thu, 27 Jan 2011 15:06:10 GMT

Deployment server doesn't really do this, and the logging framework has to work before the bundle code starts up. I mean sure some chicken-and-egg engineering could be done with a bootstrap mode and a later runtime mode, but it's not a high payoff area compared to some others right now.

please do hit up support email with an Enhancement Request about that this matters to you folks. It gets raised now and then but I don't know if it gets through to product management.

Re: Deploy $SPLUNK_HOME/etc/log.cfg via deployment server?

Jason — Fri, 18 Mar 2011 03:30:46 GMT

You could hack up deployment server to deploy to etc, but it only deploys "apps" and you probably wouldn't be able to deploy the exact file etc/log.cfg. Perhaps etc/something/local/log.cfg, but then Splunk wouldn't pick it up.

You could try symlinking etc/log.cfg to somewhere inside an app in etc/apps, then deploy that with DS, making sure to restart Splunk upon app install. That might work, but you would have to manage the symlink somehow.

Re: Deploy $SPLUNK_HOME/etc/log.cfg via deployment server?

dcparker — Tue, 17 Jul 2012 18:41:41 GMT

did you ever get this solved?

Re: Deploy $SPLUNK_HOME/etc/log.cfg via deployment server?

dstaulcu — Sat, 21 Dec 2013 20:30:17 GMT

Details on how I overcame this in another thread:

http://answers.splunk.com/answers/115363/managing-logcfg-through-deployment-server