Deployment Architecture

Multiple same TA on a single universal forwarder

MikaJustasACN
Path Finder

Hi All,

I have a question on how this should be approached. Stage:

  • There are multiple A type servers where wmi.conf is used to pull selected services related to application A.
  • There are multiple B type servers where wmi.conf is used to pull selected services related to application B.

Each server type has its own server class, and server classes use the same Windows TA but with a different wmi.conf. Everything is working well. Now, I hit a server type A with application A AND application B together on it, thus, I simply added to both server classes.

Outcome: I get application A logs but not application B. How to go around it? I don't want to create a special server class C where this happens, as this is only a portion of scope and management of such server classes would become horrible.

Windows TA is a copy of each other, just wmi.conf is changed.

Thank you for your help!

Tags (1)
0 Karma
1 Solution

MikaJustasACN
Path Finder

After triple checking everything, noticed that I have not changed the stanza name... of course with the same stanza name it will not work 🙂 Though interesting how Splunk decides the precedence of one stanza over the other.

View solution in original post

0 Karma

MikaJustasACN
Path Finder

After triple checking everything, noticed that I have not changed the stanza name... of course with the same stanza name it will not work 🙂 Though interesting how Splunk decides the precedence of one stanza over the other.

0 Karma

FrankVl
Ultra Champion

Glad you solved it already 🙂

One suggestion: don't copy the entire windows TA. Just deploy the default TA everywhere and create small separate add-ons that contain the local wmi.conf.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...