HTTP Event Collector through Deployment Server

[sk314]

I followed the instructions on this page for scenario 3 - http://dev.splunk.com/view/event-collector/SP-CAAAE73#scen3
however, when I try to add the splunk_httpinput app to a new serverclass for my deployment clients - I get an error that I haven't configured app.conf for the app. I tried to add a dummy app.conf and it still fails with the same error.

The exact error: File='/opt/splunk/etc/deployment-apps/splunk_httpinput/local/app.conf', needed for application=splunk_httpinput, not found

I am on v6.5.1

Is this a known issue? Any workaround? What am I missing?

[sk314 · Accepted solution]

Although the app.conf is not a part of the folder - creating a dummy app.conf seems to have done the trick. I had to change the ownership of app.conf to splunk user and the error vanished.

[somesoni2]

The step3 says this

Copy the entire current $SPLUNK_HOME/etc/apps/splunk_httpinput/ directory into $SPLUNK_HOME/etc/deployment-apps/. (On Windows, copy the entire current %SPLUNK_HOME%\etc\apps\splunk_httpinput\ directory into %SPLUNK_HOME%\etc\deployment-apps\.) This is a one-time step that is necessary on the deployment server.

Did you copy the whole splunk_httpinput app which comes with Splunk Enterprise? This will have all the components required, including valid app.conf.

[sk314]

I did indeed. The folder only has an inputs.conf in both default and local folder and the metadata folder.