Turning on SplunkLightForwarder via deployment Server?

[Brian_Osburn]

I'm setting up our deployment server configuration. I have the following set up in my serverclass.conf:

[serverClass:WintelServers]
whitelist.0 = pw*.wil.csc.local
whitelist.1 = pw*.cscinfo.com
whitelist.2 = pw*

[serverClass:WintelServers:app:winevntlogs]
stateOnClient = enabled
restartSplunkd = true

[serverClass:WintelServers:app:forward_to_splunk]
stateOnClient = enabled
restartSplunkd = true

[serverClass:WintelServers:app:SplunkLightForwarder]
stateOnClient = enabled
restartSplunkd = true

The Windows server I have as a deployment-client is picked up and shows the configuration and the application as enabled, but the web interface is still available.

I then tried the following:

I set up $SPLUNK_HOME/etc/deployment-apps/SplunkLightForwarder/default/app.conf with the following:

[install]
state = enabled

But that didn't work at all..

[sf_user_199]

but the web interface is still available.

I had the same exact problem

Did you copy (or symlink) the entire SplunkLightForwarder app into $SPLUNK_HOME/etc/deployment-apps? If not, and you just made a directory and stuck in the app.conf file, the shipped app will be wiped and replaced with that mostly-empty directory (and thus won't have any of the Light Forwarder configurations).

Copying the entire app is what worked for me.

[Brian_Osburn]

That's basically what I did. I set up my deployment server, made copies of the splunklightforwarder and modified the inputs.conf and outputs.conf files..

It's pretty handy!

[Brian_Osburn]

Does turning on SplunkLightForwarder shut down apps such as the search app?

Here's the deal: I was having problems with specifying what to monitor and where to forward the data to on our windows server.

I basically copied the search app over to deployment-apps and renamed it to windows_search. In this app, I configured "windows_search" with the appropriate inputs.conf to pull the event logs and assign the right index to them.

This worked fine, until I set up the LightWeightForwarder to enabled. It then stopped forwarding events.

As soon as I disabled the LightWeightForwarder it worked again 😞

Any ideas how I can make this work?

EDIT Update: UGGH, just realized it's really not working either

Okay, I guess I need to figure out how to do this. I want to be able to set up a deployment server that will (based on host name) set up forwarding, point to the right inputs, and enable lightweightforwarding. Is that possible?

[gkanapathy · Accepted solution]

Did you copy (or symlink) the entire SplunkLightForwarder app into $SPLUNK_HOME/etc/deployment-apps? If not, and you just made a directory and stuck in the app.conf file, the shipped app will be wiped and replaced with that mostly-empty directory (and thus won't have any of the Light Forwarder configurations).

[Brian_Osburn]

Whoops, I'll take a look at it tomorrow.

[Lowell]

I think there is an issue with the Light Forwarders not disabling the web interface, as you point out. I think you need to set the service to disabled (or manual) by hand.... Not sure if this is scheduled to be fixed or not...

Someone please correct me if I'm wrong.