All Apps and Add-ons

How to duplicate/clone a deployment app (Splunk Add-on for Microsoft Windows) with a different config?

jcrosby21
Path Finder

We are using the Splunk Add-on for Microsoft Windows to get Windows Event sourcetypes that we're forwarding from Universal Forwarders. We're managing our UF's with a deployment server. I would like to have different settings for inputs.conf with the Splunk_TA_windows add-on for different UF's, but would still like to maintain all types of configuration from the deployment server.

Am I correct in thinking I can duplicate the app on my deployment server to apply to other types of UF's as "Splunk_TA_windows2"? Is there a better way to leverage the same app from a deployment server with different configurations for server classes?

1 Solution

maciep
Champion

I'm not sure if it's the best approach, but that's the way we do it. We have 3 separate copies of that app we deploy to different types of devices in our env, each with different inputs settings.

View solution in original post

maciep
Champion

I'm not sure if it's the best approach, but that's the way we do it. We have 3 separate copies of that app we deploy to different types of devices in our env, each with different inputs settings.

jcrosby21
Path Finder

Glad I'm not the first one with the idea then. Has that worked out okay? When you upgrade do you just re-clone and move your local .conf's back for all 3 copies?

Little surprised there wasn't a standard answer somewhere. Seems like the need to have different configurations of an app for different service groups would be somewhat common.

0 Karma

maciep
Champion

It's worked out for our needs. We haven't upgraded the app yet, but I don't imagine much would change for the inputs between versions. And we don't really touch the apps often, only if we need to start or stop ingesting a new event id or event log, etc. And in some cases it affects all of the copies and some cases just one particular copy.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...