Splunk_TA_nix multiple inputs configurations

[carlalldis]

Hi,

I am looking to deploy the Splunk_TA_nix to multiple servers. I would like to have different inputs.conf depending on the server type, all deployed from the same deployment server.

There are a few options I have considered:

1. Renaming the Splunk_TA_nix app depending on the server type (e.g. Splunk_TA_nix_dns, Splunk_TA_nix_sql). The problem with this is that there are a few references within the app to the app name itself, and I do not want this to cause issues.
2. Creating a new app per server type with just the inputs.conf. The issue with this is that the script inputs use the relative path (e.g. ./cpu.sh); if I use this same stanza name in my app, it will not work. If the absolute path is used, it works fine, but this is bad practice as the forwarder paths may differ depending on installation type (e.g. /opt/splunk or /opt/splunkforwarder).

Has anyone had any experience with this who might be able to lend some advice please?

Thank you, Carl

[carlalldis]

Thanks tsweet; I never considered using that. Very helpful.

[tsweet_splunk · Accepted solution]

I usually use way #2 but use $SPLUNK_HOME so that you do not need to worry about the deployment type (Enterprise or Forwarder). This would require pushing both the original Splunk_TA_nix (containing the scripts) and custom Splunk_TA_nix_mycustomtype_inputs applications to the NIX UF's.

[script://$SPLUNK_HOME/etc/apps/Splunk_TA_nix/bin/netstat.sh]

[Dharani]

Hi @tsweet_splunk 

In this case , 

Do we need to install this add-on on the Linux hosts also? or pushing this configuration from DS to host is enough?

Thanks,

Dharani