https://community.splunk.com/t5/Getting-Data-In/help-needed-with-UF-settings-distributed-over-deployment-server/m-p/485715#M83142 <P>When an app is deployed to a forwarder, the entire contents of the app are replaced on the forwarder. This includes the <CODE>local</CODE> directory, unless it is excluded (see <A href="https://docs.splunk.com/Documentation/Splunk/8.0.1/Updating/Excludecontent">https://docs.splunk.com/Documentation/Splunk/8.0.1/Updating/Excludecontent</A>). Since there should not be any local configuration changes on a forwarder, this is OK.</P> <P>You can use a different app to deploy the setting, but keep in mind apps are applied in alphabetical order with the first app winning.</P> <P>Do NOT copy-paste all of a default config file to local. Copy only the attributes (and their stanza names) you need to override.</P> Tue, 21 Jan 2020 12:44:22 GMT richgalloway 2020-01-21T12:44:22Z https://community.splunk.com/t5/Getting-Data-In/help-needed-with-UF-settings-distributed-over-deployment-server/m-p/485714#M83141 <P>Hello,</P> <P>I would like to distribute one UF parameter to my clients, it is:</P> <PRE><CODE>limits.conf ... [inputproc] file_tracking_db_threshold_mb = 150 ... </CODE></PRE> <P>For that I created an app called SplunkUniversalForwarder in the deployment-apps of the deployment server. I chose the app-name deliberately the same as on the forwarders, because I hoped that the changes there will be updated to the same folder on the UF.<BR /> Inside of the /etc/deployment-apps/SplunkUniversalForwarder/local, I created limits.conf with the single parameter above.<BR /> My expectation was that this app will be distributed to the clients and the "local" directory will be created inside of the existing /opt/splunkforwarder/etc/apps/SplunkUniversalForwarder directory there. <BR /> This was the case, however the "default" directory there was wiped out. This means the app was distributed in the way that the existing one was overwritten.</P> <P>Now, before I continue, I would like to ask what is the best practice to distribute the UF parametrisation like above via the deployment server. Per my understanding, if I use another app name, then it will be created on the UF, but will the limits.conf settings then be applied to the UF?<BR /> And what about upgrading the UF software to the higher version? Will it wipe out the changes I made in "local" above?<BR /> I mean I could copy-paste what is in the default/limits.conf to local/limits.conf on the deployment server and redistribute it, but my concern is if it stays there after the UF software upgrade ...</P> <P>Please advise.</P> <P>Kamil</P> Tue, 21 Jan 2020 10:12:50 GMT https://community.splunk.com/t5/Getting-Data-In/help-needed-with-UF-settings-distributed-over-deployment-server/m-p/485714#M83141 damucka 2020-01-21T10:12:50Z https://community.splunk.com/t5/Getting-Data-In/help-needed-with-UF-settings-distributed-over-deployment-server/m-p/485715#M83142 <P>When an app is deployed to a forwarder, the entire contents of the app are replaced on the forwarder. This includes the <CODE>local</CODE> directory, unless it is excluded (see <A href="https://docs.splunk.com/Documentation/Splunk/8.0.1/Updating/Excludecontent">https://docs.splunk.com/Documentation/Splunk/8.0.1/Updating/Excludecontent</A>). Since there should not be any local configuration changes on a forwarder, this is OK.</P> <P>You can use a different app to deploy the setting, but keep in mind apps are applied in alphabetical order with the first app winning.</P> <P>Do NOT copy-paste all of a default config file to local. Copy only the attributes (and their stanza names) you need to override.</P> Tue, 21 Jan 2020 12:44:22 GMT https://community.splunk.com/t5/Getting-Data-In/help-needed-with-UF-settings-distributed-over-deployment-server/m-p/485715#M83142 richgalloway 2020-01-21T12:44:22Z