Deployment Architecture

Pushing multiple configurations out for the same app via Deployment Server

erstexas
Path Finder

All,

I'm working on converting my environment over to using the Deployment Server and for the most part I have it all figured out but I'm running into a problem when pushing multiple configurations out to different forwarders for the same app.

For example, my Windows servers will all get the Splunk_TA_windows app installed but some servers collect different sets of logs than the rest so I need to deploy different configs. Some will collect only the Security logs, some will collect only the Application logs, some will collect only DNS, etc. When I started testing I was renaming the app on the Deployment server (Splunk_TA-windows_DNS, Splunk_TA-windows_Security, Splunk_TA-windows_Applications, etc.) This works but seems kind of messy and I was wondering what others are doing to better manage this? I do not see a way to have the same base app directory and push different configs from within it.

Any suggestions?

0 Karma
1 Solution

kaufmanm
Communicator

From my understanding, there's no way to send only part of an app, and as such, the smallest components you deploy need to be broken out as you're already doing. So expect lots of folders under deployment-apps. I might only need the DNS logs from the DNS servers, but it usually isn't so expensive to monitor a file that doesn't exist on the rest of the servers, so often I'll write one app that has notes in the configuration files like "# this monitor only needed on DNS servers" so if I ever do need to refactor them I'll understand what was intended.

View solution in original post

kaufmanm
Communicator

From my understanding, there's no way to send only part of an app, and as such, the smallest components you deploy need to be broken out as you're already doing. So expect lots of folders under deployment-apps. I might only need the DNS logs from the DNS servers, but it usually isn't so expensive to monitor a file that doesn't exist on the rest of the servers, so often I'll write one app that has notes in the configuration files like "# this monitor only needed on DNS servers" so if I ever do need to refactor them I'll understand what was intended.

erstexas
Path Finder

That's what I thought. Thanks!

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...