All Apps and Add-ons

Can S.o.S. Configuration Viewer show config files from universal forwarders?

micwhite
Explorer

I followed the instructions at this page to integrate universal forwarder data in S.o.S.

http://splunk-base.splunk.com/answers/48874/how-can-i-monitor-the-resource-usage-of-my-forwarder-usi...

It works great. I see resource usage and lots of good data. However I can't see the forwarder's config files in the S.o.S Config viewer. Any way to get that part working?

1 Solution

hexx
Splunk Employee
Splunk Employee

Not at this time. The configuration file viewer of the S.o.S app relies on a custom search command (btool.py) and therefore on distributed search to layer and read configuration. Forwarders not being search peers, the app doesn't have on-demand access to their configuration.

We are, however, looking at ways to expose at least the major configuration files found on forwarders by means of new inputs to the S.o.S technology add-on.

View solution in original post

hexx
Splunk Employee
Splunk Employee

Not at this time. The configuration file viewer of the S.o.S app relies on a custom search command (btool.py) and therefore on distributed search to layer and read configuration. Forwarders not being search peers, the app doesn't have on-demand access to their configuration.

We are, however, looking at ways to expose at least the major configuration files found on forwarders by means of new inputs to the S.o.S technology add-on.

hexx
Splunk Employee
Splunk Employee

Unfortunately, we haven't got around to implement this yet. We also haven't seen enough demand for it to justify the considerable effort it would take to satisfy this requirement.

0 Karma

ben_leung
Builder

Fast forward to 2014..

Is it possible now to view conf files of forwarders by installing the sos add-on to the splunk forwarders?

0 Karma

hexx
Splunk Employee
Splunk Employee

@micwhite : Yes, it would. The same applies to search-heads which are not search-peers of each other.

0 Karma

micwhite
Explorer

Would this also apply to other search heads that are not part of search head pooling? We have several stand-alone search heads deployed for use by different teams. I'm not able to view their config files either.

0 Karma

hexx
Splunk Employee
Splunk Employee

I wholeheartedly agree!

0 Karma

micwhite
Explorer

Thanks. Would be a great feature for distributed deployments.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...