Archive
Highlighted

Deployment server app inputs.conf vs Forwarder inputs.conf

Explorer

I have updated an app inputs.conf (/opt/splunk/splunkforwarder/etc/apps/inputs_prod/local) in one of my Universal Forwarder agent and added one extra input stanza. Basically this app is pushed to Universal forwarder from Deployment server.

The inputs.conf on deployment server for this app remains same and there were no changes made.

What if the case, if I reload the deployment server does it push the same old inputs.conf to this app to the server ?

Can someone explain me this. Thanks.

Tags (1)
0 Karma
Highlighted

Re: Deployment server app inputs.conf vs Forwarder inputs.conf

Ultra Champion

I think it will revert to the DS version already upon the first next handshake between forwarder and DS, not only after a reload.

If an app is deployed from DS, you should edit it there and then push it out.

0 Karma
Highlighted

Re: Deployment server app inputs.conf vs Forwarder inputs.conf

SplunkTrust
SplunkTrust

I just tested this with a couple different changes. If you make changes to the inputs locally on the forwarder and then it will retain the changes on the UF after a reload deploy-server whether or not the changes are made in the local or default directory of that app.

The issue will come if you update the app on the deployment server. If you update the app at anytime on the deployment server then the changes on the UF will be wiped out regardless of if they are in the local or default directory.

I'd recommend updating the app on the deployment server or creating a new app and server class to include the new stanza for the client you would like to update.

View solution in original post

0 Karma