topic What happens if you deploy an inputs.conf from a DS if an inputs.conf already exists? in Getting Data In

What happens if you deploy an inputs.conf from a DS if an inputs.conf already exists?

russell120 — Tue, 26 Feb 2019 03:33:52 GMT

Hi,

Its just as the title suggests. If a have a deployment client with an inputs.conf thats already configured as such:

[monitor:///var/log/httpd]
index = web

If I push this inputs.conf to that deployment client from a deployment server?:

[monitor:///var/log/httpd]
index = webLogs

Will the web or webLogs index be populated with events? Or will both be?

Re: What happens if you deploy an inputs.conf from a DS if an inputs.conf already exists?

burwell — Tue, 26 Feb 2019 03:50:41 GMT

The deployment server works at the app level.

And the app has a set of files in directories which could include an inputs.conf.

So if you already had an inputs.conf in /opt/splunk/etc/myapp/local/inputs.conf and the server.conf is going to deploy myapp to the client it will overwrite it.

Re: What happens if you deploy an inputs.conf from a DS if an inputs.conf already exists?

FrankVl — Tue, 26 Feb 2019 08:17:12 GMT

Exactly. And if they are not in the same app / folder, then Splunk determines the precedence based on the location of each inputs.conf: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Wheretofindtheconfigurationfiles