Deployment Architecture

How to deploy updates to inputs.conf, outputs.conf, and deploymentclient.conf files to the "C:\Program Files\Splunk\etc\system\local" directory?

thomas_forbes
Communicator

I have created an app (which includes updates for the inputs.conf, outputs.conf and deploymentclient.conf files), an associated Server class, and have successfully deployed the app to all clients I have listed in the Forwarder Management section. On the server-side, the app resides in the /opt/splunk/etc/deployment-apps directory. On the client side the apps are downloaded to the C:/Program Files/Splunk/etc/apps directory. In order for my forwarders to pass on the relevant information to my indexer, I need the .conf files contained in the app to be pushed out to the C:\Program Files\Splunk\etc\system\local directory. How can I make this happen?

Thank you,
Tom Forbes

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

The files that you're trying to send to your clients are having global context (not app specific), hence, it doesn't have to be deployed on the etc/system/local path necessarily.
See the precedence of Splunk configuration files here http://docs.splunk.com/Documentation/Splunk/6.2.4/admin/Wheretofindtheconfigurationfiles#Precedence_...

Based on this, if there is no System local (/etc/system/local) entries with maching stanza name exists, your configuration files from app folders will just work fine.

View solution in original post

bmacias84
Champion

For deploying anything to $SPLUNK_HOME/etc/system/local I would recommend using a configuration management suite such as chef, puppet, or sccm. There is no way of managing $SPLUNK_HOME/etc/system/local through Splunk Deployment methods.

If configuration management software is not an option you can also use splunk remote cli to set the deployment client. For the remote cli to be available the default password must be change on every forwarder. Then you would also have to script it to run for all forwarders.

thomas_forbes
Communicator

Thank you for your input. I was looking at SCCM, but wanted to get this to work in Splunk first. If I had not used precedence order as it relates to configuration files, I would have gone this route.

Thanks again.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The files that you're trying to send to your clients are having global context (not app specific), hence, it doesn't have to be deployed on the etc/system/local path necessarily.
See the precedence of Splunk configuration files here http://docs.splunk.com/Documentation/Splunk/6.2.4/admin/Wheretofindtheconfigurationfiles#Precedence_...

Based on this, if there is no System local (/etc/system/local) entries with maching stanza name exists, your configuration files from app folders will just work fine.

thomas_forbes
Communicator

Thank you for the answer you provided. This solution worked perfectly for me. I was looking at precedence order, but did dig deep enough as I still had the problem with deploying my configuration updates to my clients.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...