Deployment Architecture

Sending updates to conf file using deployment server

ajaysamantbms
Explorer

Is it possible to update only one stanza of a conf file (e.g inputs.conf) and not touch other parts of configuration.

What i understand is when i push the conf file through deployment server, entire file will get replaced with the new file from the server..

Tags (1)
0 Karma
1 Solution

aholzer
Motivator

You are correct, it will replace the entire file. For that matter it will in fact replace the entire app. If you have appA on your deployserver, and it only contains inputs.conf, and your forwarder has appA that contains inputs.conf and outputs.conf. Once your deployserver sends the update, your appA will not have the outputs.conf.

What you should do is make a copy of the app onto your deployserver, make the necessary changes on your deployserver, and from now on only ever make changes on the deploysever.

Hope this helps.

View solution in original post

aholzer
Motivator

You are correct, it will replace the entire file. For that matter it will in fact replace the entire app. If you have appA on your deployserver, and it only contains inputs.conf, and your forwarder has appA that contains inputs.conf and outputs.conf. Once your deployserver sends the update, your appA will not have the outputs.conf.

What you should do is make a copy of the app onto your deployserver, make the necessary changes on your deployserver, and from now on only ever make changes on the deploysever.

Hope this helps.

Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...