All Apps and Add-ons

Is it possible to have different apps/configurations with Splunk add-on for Windows?

rocarril
Engager

The app collects windows events, hostmon, regmon, and perfmon.

I'd like to have a modular approach where:
1) All systems are assigned to collect windows events
2) Select systems are assigned to collect hostmon, regmon, and/or perfmon

I tried creating separate folders (apps) with different inputs.conf files, but it seems the "main" app (windows events) is overriding the others.

Tags (1)
0 Karma

FrankVl
Ultra Champion

Rather than copying the entire TA and making modifications to multiple copies of the TA (and keeping both updated with new releases etc.), I'd rather suggest to install the TA just as is, without any active inputs.conf. And create separate small apps that contain the inputs.conf that you need.

When deploying on universal forwarders, I think you don't even need the TA itself at all on the forwarders?

A similar question has been discussed recently in the following thread: https://answers.splunk.com/answers/620404/deployment-server-how-to-handle-a-single-add-on-wi.html

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi rocarril,
yes, yoo can create two TAs, called e.g. TA_Windows_all and TA_Windows_perfmon, copying the same TA_Windows and customizing each one for your needs.
After you need to create two different ServerClasses for your systems putting the correct servers in each one.

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...