Deployment Architecture

Deployment Server - App deployment: remove file monitoring from splunk for single UF

rchittip
Path Finder

Hi,

I have a deployment server in my environment. We have an app exists "digitalApplication" targeting to index multiple files from UFs. This app targeted to all linux servers.

Since this app exists in all universal forwarder now, I have received a requirement to stop monitoring a File (Access.log) in one of the UF server. This states that "digitalApplication" exists in UF /etc/apps directory with Access.log.

Please note that app "digitalApplication" contains many other files from deployment server.

Now the question is, how to disable monitoring for Access.log in one single UF.

Thanks,
Ramu Chittiprolu

0 Karma

Azeemering
Builder

Normally I would say that you can blacklist a single UF / host in the serverclass configuration (Exclude (blacklist)
On the Deployment Server go to:
Settings->Forwarder Management-->Server Classes and edit the serverclass. Here you have the option to blacklist hosts.

But as you where saying that the app contains many more file monitors I would just create a new app and serverclass for that particular host.

Another possible solution would be to route and filter the specific data from that host to the Nullqueue:
https://docs.splunk.com/Documentation/Splunk/7.3.0/Forwarding/Routeandfilterdatad

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...