Deployment Architecture

How to merge two apps in deployment server


I am looking for some help in managing apps using the deployment server. Here is the case.
I have two different apps, sending two different logs from the same set of servers. The index and sourcetype are the same. They use the same server class.

App 1:




Now I have a new requirement to send the all the logs from all the sub directories. There are close to 250 sub directories


How to do I achieve this?
• Should I disable App1 and App2, create new app to monitor://G:\Logfiles\*\*.log. if yes, how to disable app
• Should I delete App1 and App2, create new app to monitor://G:\Logfiles\*\*.log
• Keep App1 and App2 as it is and create new app to monitor://G:\Logfiles\*\*.log. Will this cause events duplicating
• Keep App1 and App2 as it is and create new app to monitor://G:\Logfiles\*\*.log excluding the subdir1, subdir2, subdir3 and subdir4
Any other ways of doing this?

0 Karma

Revered Legend

Go with option 2 - remove app1 and app2 from that serverclass and add app3 with new wildcarded input stanza.

0 Karma


I would create a new app (we will call it app3), merge the inputs from both app1 and app2, then uninstall app1 and app2 via deployment server's UI by removing it from the server classes, and then deploy app3. You can use a tool like notepad++ with the "compare" plugin to compare both inputs.conf and merge between the two.

monitor://G:\Logfiles**.log will not work, should be

but even that I would recommend against as it may create a large CPU overhead of the splunkd process.

Would be best to just merge the stanzas from each app into a new inputs.conf.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!