We have all our forwarders connected to the Deployment Server. One of the first apps we would like to deploy is the Splunk_TA_windows add-on. We have the app configured with all the common input settings but our Domain Controllers have an additional WinEventLog source for which inputs.conf needs to be adjusted.
e.g. inputs.conf that is applicable for all Windows Servers will have
We cant deploy the same app everywhere because for most of the servers, source D does not exist. What is the best way forward?
Should we create a copy of this same app named Splunk_TA_windows_DC and make changes there? So All member servers get Splunk_TA_windows and all Domain Controllers get Splunk_TA_windows_DC. If we do this, are there any special files to be edited apart from just renaming the folder?
Or is it better to create a brand new app just for this one additional input and have it deployed to Domain Controller Class along with the default Splunk_TA_windows?