All Apps and Add-ons

How to duplicate/clone a deployment app (Splunk Add-on for Microsoft Windows) with a different config?

jcrosby21
Explorer

We are using the Splunk Add-on for Microsoft Windows to get Windows Event sourcetypes that we're forwarding from Universal Forwarders. We're managing our UF's with a deployment server. I would like to have different settings for inputs.conf with the Splunk_TA_windows add-on for different UF's, but would still like to maintain all types of configuration from the deployment server.

Am I correct in thinking I can duplicate the app on my deployment server to apply to other types of UF's as "Splunk_TA_windows2"? Is there a better way to leverage the same app from a deployment server with different configurations for server classes?

1 Solution

maciep
Champion

I'm not sure if it's the best approach, but that's the way we do it. We have 3 separate copies of that app we deploy to different types of devices in our env, each with different inputs settings.

View solution in original post

maciep
Champion

I'm not sure if it's the best approach, but that's the way we do it. We have 3 separate copies of that app we deploy to different types of devices in our env, each with different inputs settings.

View solution in original post

jcrosby21
Explorer

Glad I'm not the first one with the idea then. Has that worked out okay? When you upgrade do you just re-clone and move your local .conf's back for all 3 copies?

Little surprised there wasn't a standard answer somewhere. Seems like the need to have different configurations of an app for different service groups would be somewhat common.

0 Karma

maciep
Champion

It's worked out for our needs. We haven't upgraded the app yet, but I don't imagine much would change for the inputs between versions. And we don't really touch the apps often, only if we need to start or stop ingesting a new event id or event log, etc. And in some cases it affects all of the copies and some cases just one particular copy.

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!