Deployment Architecture

Distributing inputs.conf with deployment server

damucka
Builder

Hello,

I would like to distribute and make changes to the inputs.conf files of the universal forwarders using deployment server.
So far I have created a new directory in the /etc/deployment-apps:

MLBSO_HANA_inputs

and created an inputs.conf in the default sub-folder of it. After configuring things in the Settings -> forwarder Management my "App" and the corresponding inputs.conf has been distributed, all fine.
But now I want to make changes to this inputs.conf, hoping it will also reach the forwarder, this is however not the case. The connection between forwarder and the deployment server is fine.
Do I miss-understand the concept of the pushing changes? Should that not be automatic?

Kind Regards,
Kamil

Tags (1)
0 Karma
1 Solution

Vijeta
Influencer

@damucka - try reloading the deploy server manually using command line.
$ /opt/splunk/bin/splunk reload deploy-server -class

View solution in original post

0 Karma

Vijeta
Influencer

@damucka - try reloading the deploy server manually using command line.
$ /opt/splunk/bin/splunk reload deploy-server -class

0 Karma

damucka
Builder

@Vijeta

Thank you, it worked.

Kind Regards,
Kamil

0 Karma

adonio
Ultra Champion

you have to modify the inputs.conf in your app on the deployment server under .../deployment-apps/
this is the app that is being pushed to all your forwarders

0 Karma

damucka
Builder

Hello @adonio

Thank you.
This is what I am doing, the path is:

~/etc/deployment-apps/MLBSO_HANA_inputs/default>

so, the MLBSO_HANA_inputs is under .../deployment-apps/. As mentioned, the first initial time it works, but then if I make the change to the inputs.conf inside the default directory, then it is not reflected on the forwarders.
Or do you mean that the inputs.conf should be placed really directly in the .../deployment-apps/ directory itself? But then where would it land on the forwarder? And most important, how would I distinguish between different inputs.conf files that I have to distribute to different forwarders? Now I have it under separate "apps" sub-folders of the ../deployment-apps/ folder.

Kind Regards,
Kamil

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...