Deployment Architecture

Deployment Server - How to deploy same app with different configs based on Classes?



We have all our forwarders connected to the Deployment Server. One of the first apps we would like to deploy is the Splunk_TA_windows add-on. We have the app configured with all the common input settings but our Domain Controllers have an additional WinEventLog source for which inputs.conf needs to be adjusted.

e.g. inputs.conf that is applicable for all Windows Servers will have


But there is an additional input D only on Domain Controllers so inputs.conf there should look like:


We cant deploy the same app everywhere because for most of the servers, source D does not exist. What is the best way forward?

Should we create a copy of this same app named Splunk_TA_windows_DC and make changes there? So All member servers get Splunk_TA_windows and all Domain Controllers get Splunk_TA_windows_DC. If we do this, are there any special files to be edited apart from just renaming the folder?

Or is it better to create a brand new app just for this one additional input and have it deployed to Domain Controller Class along with the default Splunk_TA_windows?


~ Abhi

0 Karma


renaming the TA is exactly what i did. So in my case i have a ta_windows_endpoints and a ta_windows_servers. Create your separate server classes and then reload the deployment server configs using:


Not saying this is the best way, but it certainly works for me.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!