Deployment Architecture

Deployment server: How to handle a single add-on with multiple configuration versions?

Communicator

Hi,

I have to manage multiple UF agent with a single deployment server.
I have to set up different whitelist/blacklist for different server classes. For example, I have to collect events with different EventID from the DCs and from the other Win servers. So I have to assign the SplunkTAwindows add-on to ServersClassA and ServerClassB, but with different inputs.conf.

How can I do this? Is it safe to rename the Add-on's directory to SplunkTAwindowsDC, SplunkTAwindowsWinSer, etc? This way I can separate the configs.

Regards,
István

0 Karma
1 Solution

Ultra Champion

Do you really need SplunkTAWindows on the UFs?

I would check which config you actually need (mostly inputs.conf I guess?) and put that in specific small custom add-ons and deploy that to the relevant UFs.

Even if for some reason you would need SplunkTAWindows deployed, you could still do that but keep the custom configuration in separate apps. I wouldn't really recommend using multiple (renamed) copies of the same off-the-shelve TA, that is going to be hard to maintain.

View solution in original post

0 Karma

Ultra Champion

Do you really need SplunkTAWindows on the UFs?

I would check which config you actually need (mostly inputs.conf I guess?) and put that in specific small custom add-ons and deploy that to the relevant UFs.

Even if for some reason you would need SplunkTAWindows deployed, you could still do that but keep the custom configuration in separate apps. I wouldn't really recommend using multiple (renamed) copies of the same off-the-shelve TA, that is going to be hard to maintain.

View solution in original post

0 Karma

Communicator

Hi,

As far as I know, SplunkTAWindows contains WinEventLog://* input stanzas. Unfortunately, I don't know Splunk systems in details yet.

So, in general, I can use the default SplunkTAWindows on all server, and create some custom add-on with the specific config(inputs.conf) and push them alongside with the default SplunkTAWindows add-on?

Regards,
István

0 Karma

Ultra Champion

Yes.

But once more: I don't think you really need the full TA on your UFs, since that TA (apart from the inputs.conf) mostly consists of index time and search time stuff, which your UF won't handle, the TA needs to be on your indexer(s) (or the first HF that exist between your UF and Indexers) and on your search head(s).

0 Karma

Communicator

Thank you. I understand it, so far, I was on the safe side, use the whole add-on everywhere, I did not feel the Force in me to select which file needed, which doesn't. (And guide says Install the add-on...)

Regards,
István

0 Karma