How to add a new data source to inputs.conf?

[Ansab]

Architecture: Distributed - Deployment Server pushes changes to forwarders (1 hvyfwd, 2 universal) - Clustered indexers,  there is a cluster master 

I made a change in inputs.conf file stanza to edit IP address and hostname for one of the logsources. I tried to push that change to forwarders through restarting the server class on deployment server gui. However, I am unable to see those logs come in from that IP and source name. 

Is there a step that I am missing?

[Ansab]

Thank you @richgalloway  - These were all the steps I as doing and it still was not letting it push the chang eto forwarders. I had to manually edit inputs.conf files on the forwarders (opt/etc/system/local) to match the change I made on the deployment server and it then started to ingest those logs. Could it be not updating the deployment server to current version?

[richgalloway]

I think I see what's happening.  Deployment Servers cannot update any file in $SPLUNK_HOME/etc/system/local.  They can only update files in $SPLUNK_HOME/etc/apps/*.

Your inpurs.conf file should be in a app in the DS's $SPLUNK_HOME/etc/deployment-apps directory.  They will be deployed to forwarders from there.

[richgalloway]

Once the inputs.conf file is modified the forwarder should detect the change the next time it phones home and re-install the app.  The change will not be applied, however, until the next time the forwarder restarts.  To force that to happen, be sure to check the "Restart splunkd" box in the app description on the Deployment Server.