Deployment Architecture

Pushing multiple configurations out for the same app via Deployment Server

erstexas
Path Finder

All,

I'm working on converting my environment over to using the Deployment Server and for the most part I have it all figured out but I'm running into a problem when pushing multiple configurations out to different forwarders for the same app.

For example, my Windows servers will all get the Splunk_TA_windows app installed but some servers collect different sets of logs than the rest so I need to deploy different configs. Some will collect only the Security logs, some will collect only the Application logs, some will collect only DNS, etc. When I started testing I was renaming the app on the Deployment server (Splunk_TA-windows_DNS, Splunk_TA-windows_Security, Splunk_TA-windows_Applications, etc.) This works but seems kind of messy and I was wondering what others are doing to better manage this? I do not see a way to have the same base app directory and push different configs from within it.

Any suggestions?

0 Karma
1 Solution

kaufmanm
Communicator

From my understanding, there's no way to send only part of an app, and as such, the smallest components you deploy need to be broken out as you're already doing. So expect lots of folders under deployment-apps. I might only need the DNS logs from the DNS servers, but it usually isn't so expensive to monitor a file that doesn't exist on the rest of the servers, so often I'll write one app that has notes in the configuration files like "# this monitor only needed on DNS servers" so if I ever do need to refactor them I'll understand what was intended.

View solution in original post

kaufmanm
Communicator

From my understanding, there's no way to send only part of an app, and as such, the smallest components you deploy need to be broken out as you're already doing. So expect lots of folders under deployment-apps. I might only need the DNS logs from the DNS servers, but it usually isn't so expensive to monitor a file that doesn't exist on the rest of the servers, so often I'll write one app that has notes in the configuration files like "# this monitor only needed on DNS servers" so if I ever do need to refactor them I'll understand what was intended.

erstexas
Path Finder

That's what I thought. Thanks!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...