Deployment Architecture

DeploymentClient : haven't configured correct index yet still working; do I need to delete old configs?

krussell101
Path Finder

I have something working and I'm not sure why it's working.

All of my forwarders are now set up as deployment clients. And all seems to be working correctly. Except I just found an error in my server class "production_servers" so it was not getting deployed. And that's where I set an index=prod. I can't find any other server classes where the index is set to prod. Yet all the appropriate events are still being put in the prod index.

Is this configuration coming from the old $SPLUNK_HOME/etc/system/local/inputs.conf file on the production forwarders? I did not remove those files from any of my deployment clients. I saw nothing explicit in the documentation to tell me to do something.

Is that file taking precedence over what the deployment server is sending? All guidance appreciated.

Thanks!

Tags (1)
0 Karma

jsb22
Path Finder

If you're deploying your configuration via a deployment server, I believe the config files you are editing on a deployment server should be pushed to etc/apps/deploymentapp, not under etc/system/local. I know in my environment, I don't have anything more than the "[default] host=hostname" in etc/system/local/inputs.conf file, and specify the other items (index=indexname) n the etc/apps/deploymentapp/local/inputs.conf. I would assume(and maybe i shouldn't) that your deployment app should be deployed to etc/apps/production_servers/local/inputs.conf. If your etc/system/local/inputs.conf specifies "index=prod", then I believe it will default all data to that unless otherwize specified in the deployment app in etc/apps/production_server/local/inputs.conf

0 Karma

krussell101
Path Finder

To summarize, you DO think I will have to remove etc/apps/deploymentapp/local/inputs.conf on the clients? I guess that makes sense. I wish it had been explicitly called out in the documentation.

This probably goes to configuration file precedence which I am certainly not an expert on.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...