Linux TA app issue - different index based on hostname and OS

[cameronr0705]

We have 3k+ servers comprised of Linux, Windows, Solaris, and AIX. We would like to place different customers in separate indexes. We have this setup in Windows by having a customer app that points to the customer index and having multiple copies of the Windows app on our deployment server. This does not work for the Linux TA app since it appears there are files where the path is hardcoded to Splunk_TA_nix. Any ideas how to send data to the correct customer index based on the hostname and OS rather than have all Linux OS data in the same index?

[FrankVl]

Regardless of the TA, you could still create separate, customer specific, apps with just inputs.conf (and perhaps a few custom props/transforms where needed) for the respective inputs and assign those to the customer specific indexes. While keeping the TA itself generic.

That is anyway (also for windows TA) a much better approach than duplicating entire TAs, only to customize a small part of its settings per customer. That is a disaster waiting to happen if one of the copies is missed in an update, or customizations are done inconsistently etc.

Keep 1 instance of the official TA and put any customer specific diversification in separate small apps that only contain those custom settings, in addition to (or overriding) the config from the original TA.

[cameronr0705]

I guess I don't follow. When I push the small app containing just the inputs.conf with the updated index using the deployment server how does Splunk know to use the rest of the Windows or Linux TA? Is there documentation somewhere? I agree having multiple copies of the same TA come updates there is a chance one will get missed and cause issues. Thanks

[FrankVl]

Because all of the configuration in those TAs is based on sourcetypes and sources etc. So as long as you set those correctly in your custom input, the rest will still work as expected. Configurations don't have to be together in 1 app to work together. Splunk merges all the installed apps together (with some clear rules on which takes precedence over what) to determine its configuration state.