Deployment Server - How to deploy same app with different configs based on Classes?

[att35]

Hi,

We have all our forwarders connected to the Deployment Server. One of the first apps we would like to deploy is the Splunk_TA_windows add-on. We have the app configured with all the common input settings but our Domain Controllers have an additional WinEventLog source for which inputs.conf needs to be adjusted.

e.g. inputs.conf that is applicable for all Windows Servers will have

[WinEventLog://A]
[WinEventLog://B]
[WinEventLog://C]

But there is an additional input D only on Domain Controllers so inputs.conf there should look like:

[WinEventLog://A]
[WinEventLog://B]
[WinEventLog://C]
[WinEventLog://D]

We cant deploy the same app everywhere because for most of the servers, source D does not exist. What is the best way forward?

Should we create a copy of this same app named Splunk_TA_windows_DC and make changes there? So All member servers get Splunk_TA_windows and all Domain Controllers get Splunk_TA_windows_DC. If we do this, are there any special files to be edited apart from just renaming the folder?

Or is it better to create a brand new app just for this one additional input and have it deployed to Domain Controller Class along with the default Splunk_TA_windows?

Thanks,

~ Abhi

[CarsonZa]

renaming the TA is exactly what i did. So in my case i have a ta_windows_endpoints and a ta_windows_servers. Create your separate server classes and then reload the deployment server configs using:

https://<yourserver>:8089/services/deployment/server/config/_reload

Not saying this is the best way, but it certainly works for me.