topic Deployment server app inputs.conf vs Forwarder inputs.conf in Getting Data In

Deployment server app inputs.conf vs Forwarder inputs.conf

rchittip — Wed, 07 Feb 2018 12:07:30 GMT

I have updated an app inputs.conf (/opt/splunk/splunkforwarder/etc/apps/inputs_prod/local) in one of my Universal Forwarder agent and added one extra input stanza. Basically this app is pushed to Universal forwarder from Deployment server.

The inputs.conf on deployment server for this app remains same and there were no changes made.

What if the case, if I reload the deployment server does it push the same old inputs.conf to this app to the server ?

Can someone explain me this. Thanks.

Re: Deployment server app inputs.conf vs Forwarder inputs.conf

FrankVl — Wed, 07 Feb 2018 12:45:34 GMT

I think it will revert to the DS version already upon the first next handshake between forwarder and DS, not only after a reload.

If an app is deployed from DS, you should edit it there and then push it out.

Re: Deployment server app inputs.conf vs Forwarder inputs.conf

mdsnmss — Wed, 07 Feb 2018 13:05:51 GMT

I just tested this with a couple different changes. If you make changes to the inputs locally on the forwarder and then it will retain the changes on the UF after a reload deploy-server whether or not the changes are made in the local or default directory of that app.

The issue will come if you update the app on the deployment server. If you update the app at anytime on the deployment server then the changes on the UF will be wiped out regardless of if they are in the local or default directory.

I'd recommend updating the app on the deployment server or creating a new app and server class to include the new stanza for the client you would like to update.