Deployment Architecture

Linux TA app issue - different index based on hostname and OS

cameronr0705
New Member

We have 3k+ servers comprised of Linux, Windows, Solaris, and AIX. We would like to place different customers in separate indexes. We have this setup in Windows by having a customer app that points to the customer index and having multiple copies of the Windows app on our deployment server. This does not work for the Linux TA app since it appears there are files where the path is hardcoded to Splunk_TA_nix. Any ideas how to send data to the correct customer index based on the hostname and OS rather than have all Linux OS data in the same index?

Tags (1)
0 Karma

FrankVl
Ultra Champion

Regardless of the TA, you could still create separate, customer specific, apps with just inputs.conf (and perhaps a few custom props/transforms where needed) for the respective inputs and assign those to the customer specific indexes. While keeping the TA itself generic.

That is anyway (also for windows TA) a much better approach than duplicating entire TAs, only to customize a small part of its settings per customer. That is a disaster waiting to happen if one of the copies is missed in an update, or customizations are done inconsistently etc.

Keep 1 instance of the official TA and put any customer specific diversification in separate small apps that only contain those custom settings, in addition to (or overriding) the config from the original TA.

0 Karma

cameronr0705
New Member

I guess I don't follow. When I push the small app containing just the inputs.conf with the updated index using the deployment server how does Splunk know to use the rest of the Windows or Linux TA? Is there documentation somewhere? I agree having multiple copies of the same TA come updates there is a chance one will get missed and cause issues. Thanks

0 Karma

FrankVl
Ultra Champion

Because all of the configuration in those TAs is based on sourcetypes and sources etc. So as long as you set those correctly in your custom input, the rest will still work as expected. Configurations don't have to be together in 1 app to work together. Splunk merges all the installed apps together (with some clear rules on which takes precedence over what) to determine its configuration state.

0 Karma
Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...