I am looking for some help in managing apps using the deployment server. Here is the case.
I have two different apps, sending two different logs from the same set of servers. The index and sourcetype are the same. They use the same server class.
Now I have a new requirement to send the all the logs from all the sub directories. There are close to 250 sub directories
How to do I achieve this?
• Should I disable App1 and App2, create new app to monitor://G:\Logfiles\*\*.log. if yes, how to disable app
• Should I delete App1 and App2, create new app to monitor://G:\Logfiles\*\*.log
• Keep App1 and App2 as it is and create new app to monitor://G:\Logfiles\*\*.log. Will this cause events duplicating
• Keep App1 and App2 as it is and create new app to monitor://G:\Logfiles\*\*.log excluding the subdir1, subdir2, subdir3 and subdir4
Any other ways of doing this?
I would create a new app (we will call it app3), merge the inputs from both app1 and app2, then uninstall app1 and app2 via deployment server's UI by removing it from the server classes, and then deploy app3. You can use a tool like notepad++ with the "compare" plugin to compare both inputs.conf and merge between the two.
monitor://G:\Logfiles**.log will not work, should be
but even that I would recommend against as it may create a large CPU overhead of the splunkd process.
Would be best to just merge the stanzas from each app into a new inputs.conf.