I have data from different sources already forwarded to a forwarders. Indexes already created on a deployment-master combined server, next how can I assign the data per source to a desired index?
Thanks,
If you created an app in the deployment-apps
directory on your Deployment Server
and it has an inputs.conf
that defines index values, you still have to deploy this app to your indexers
by creating a serverclass
inside of $SPLUNK_HOME/etc/system/local/serverclass.conf
and add a whitelist
setting to this serverclass
that contains the identities of your indexers
. Then add the app that you created to the serverclass
. Then restart the Deployment Server and let the magic happen.
Excellent information - thank you everyone.
If you created an app in the deployment-apps
directory on your Deployment Server
and it has an inputs.conf
that defines index values, you still have to deploy this app to your indexers
by creating a serverclass
inside of $SPLUNK_HOME/etc/system/local/serverclass.conf
and add a whitelist
setting to this serverclass
that contains the identities of your indexers
. Then add the app that you created to the serverclass
. Then restart the Deployment Server and let the magic happen.
Go through this document.
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles
Thanks,
Do I need to update these .conf files on the deployment server or other instances?
Thanks,
Hi @vnguyen46 , You need to update the indexes.conf in ClusterMaster and push it to indexers and inputs.conf on Deployment server push it to forwarders
Update serverclass.conf in DS(Deployment Server)
props.conf is not mandatory
You have to update in index.conf ,input.conf ,props.conf, serverclass.conf files to assign data to desired index.
Thanks
Anantha.