Managing Splunk LF with Deployment Server

[balbano]

Hey guys,

I managed to setup deployment server / client test model with our 2 central indexers and a test sample of servers. I realize that the test servers phone home to the deployment server in intervals and pull any new dafault config changes. However, we do not necessarily have a standardization with logging. Some servers store logs one place... some servers could store logs in another place. Can we still manually configure inputs.conf in $Splunk_Home/etc/system/local on the forwarders to overwrite the default configurations being pulled?

Any help you can provide would be great. Thanks.

Brian A

[piebob · Accepted solution]

yes, the forwarders will use the same logic (described here: http://www.splunk.com/base/Documentation/latest/Admin/Wheretofindtheconfigurationfiles ) to read their configuration files as a standard Splunk deployment does.