All Apps and Add-ons

Splunk_TA_nix multiple inputs configurations

Explorer

Hi,

I am looking to deploy the Splunk_TA_nix to multiple servers. I would like to have different inputs.conf depending on the server type, all deployed from the same deployment server.

There are a few options I have considered:

  1. Renaming the Splunk_TA_nix app depending on the server type (e.g. Splunk_TA_nix_dns, Splunk_TA_nix_sql). The problem with this is that there are a few references within the app to the app name itself, and I do not want this to cause issues.
  2. Creating a new app per server type with just the inputs.conf. The issue with this is that the script inputs use the relative path (e.g. ./cpu.sh); if I use this same stanza name in my app, it will not work. If the absolute path is used, it works fine, but this is bad practice as the forwarder paths may differ depending on installation type (e.g. /opt/splunk or /opt/splunkforwarder).

Has anyone had any experience with this who might be able to lend some advice please?

Thank you, Carl

0 Karma
1 Solution

Splunk Employee
Splunk Employee

I usually use way #2 but use $SPLUNK_HOME so that you do not need to worry about the deployment type (Enterprise or Forwarder). This would require pushing both the original Splunk_TA_nix (containing the scripts) and custom Splunk_TA_nix_mycustomtype_inputs applications to the NIX UF's.

[script://$SPLUNK_HOME/etc/apps/Splunk_TA_nix/bin/netstat.sh]

View solution in original post

Explorer

Thanks tsweet; I never considered using that. Very helpful.

0 Karma

Splunk Employee
Splunk Employee

I usually use way #2 but use $SPLUNK_HOME so that you do not need to worry about the deployment type (Enterprise or Forwarder). This would require pushing both the original Splunk_TA_nix (containing the scripts) and custom Splunk_TA_nix_mycustomtype_inputs applications to the NIX UF's.

[script://$SPLUNK_HOME/etc/apps/Splunk_TA_nix/bin/netstat.sh]

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!