topic inputs.conf gets overwritten on HF/DS in Getting Data In

inputs.conf gets overwritten on HF/DS

ojay — Wed, 30 Jun 2021 12:47:10 GMT

hi all,

I have a file that i want to monitor on the Heavy Forwarder HF which is the Deployment Server DS at the same time.

Since a deployment server cannot be a client of itself I place the manually created app to

/opt/splunk/etc/apps/appname/default/inputs.conf

Now after i reconfigure the inputs. After some time the updated gets randomly removed again. As if it is a deployed app.

My question now. What is the best practice to monitor local files on a HF/DS?

Best,

Re: inputs.conf gets overwritten on HF/DS

codebuilder — Fri, 02 Jul 2021 19:58:48 GMT

A deployment server being a client of itself is not supported but is possible. Check to be certain that you you don't have deploymentclient.conf set on the DS under $SPLUNK_HOME/etc/system/local/

Re: inputs.conf gets overwritten on HF/DS

hoaxm3 — Sat, 03 Jul 2021 16:23:19 GMT

Any app in the /etc/apps directory would not be affected from the forwarder management side of things. The issue is more than likely that you are setting your configs in the $splunk_home/etc/apps/appname/default/.. directory. When you create a base config/app, your configs need to live in the /appname/local/*.conf directory. This lets Splunk know that these are custom configs and should not be changed. Additionally, make sure that you dont have any affecting stanzas matching your inputs files. Check with btool if there are any inputs taking precedence before your config:

splunk btool inputs list <stanza> --debug