Deployment Architecture

Pushing multiple configurations out for the same app via Deployment Server

erstexas
Path Finder

All,

I'm working on converting my environment over to using the Deployment Server and for the most part I have it all figured out but I'm running into a problem when pushing multiple configurations out to different forwarders for the same app.

For example, my Windows servers will all get the Splunk_TA_windows app installed but some servers collect different sets of logs than the rest so I need to deploy different configs. Some will collect only the Security logs, some will collect only the Application logs, some will collect only DNS, etc. When I started testing I was renaming the app on the Deployment server (Splunk_TA-windows_DNS, Splunk_TA-windows_Security, Splunk_TA-windows_Applications, etc.) This works but seems kind of messy and I was wondering what others are doing to better manage this? I do not see a way to have the same base app directory and push different configs from within it.

Any suggestions?

0 Karma
1 Solution

kaufmanm
Communicator

From my understanding, there's no way to send only part of an app, and as such, the smallest components you deploy need to be broken out as you're already doing. So expect lots of folders under deployment-apps. I might only need the DNS logs from the DNS servers, but it usually isn't so expensive to monitor a file that doesn't exist on the rest of the servers, so often I'll write one app that has notes in the configuration files like "# this monitor only needed on DNS servers" so if I ever do need to refactor them I'll understand what was intended.

View solution in original post

kaufmanm
Communicator

From my understanding, there's no way to send only part of an app, and as such, the smallest components you deploy need to be broken out as you're already doing. So expect lots of folders under deployment-apps. I might only need the DNS logs from the DNS servers, but it usually isn't so expensive to monitor a file that doesn't exist on the rest of the servers, so often I'll write one app that has notes in the configuration files like "# this monitor only needed on DNS servers" so if I ever do need to refactor them I'll understand what was intended.

erstexas
Path Finder

That's what I thought. Thanks!

0 Karma
Get Updates on the Splunk Community!

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...

Want to Reduce Costs, Mitigate Risk, Improve Performance, or Increase Efficiencies? ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...