Deployment Architecture

Using DeploymentServer to deploy Splunk Tech Add-On for *NIX

Path Finder

I have a deploymentServer and a couple dozen DeploymentClients. All deploymentClients are universal forwarders.

There are several server classes defined within the deploymentServer. Examples are: linux_servers, production_servers, test_servers, application_A_servers, application_B_servers, etc.

Using the Tech AddOn for Unix, I want to collect server level details, but not all the same details for all Forwarders. I want to collect more data from prod servers than test servers for example. I may need memory data for application A but not application B. We're running up against our indexing limit so I want to be precise about what I collect and what I don't.

I have TA for UNIX working on every host, but it's configured separately on each host which is a pain, so I thought of using the deployment server for this.

I removed the TA for UNIX on a test host, created a new server class on the deployment server ("Splunk_TA_nix") and have successfully gotten the results I configured from the test host. So I know this is a possibility. However, this doesn't allow me to vary the data I collect based on other server classes.

Splunk_TA_nix has a bin directory with many scripts referenced in its inputs.conf file. The format is as such:

SHOULD I . . .

Delete the new server class Splunk_TA_nix. Make all changes to existing inputs.conf files for already-defined server classes. [[ I would either make copies of the Splunk_TA_nix/bin directory in all the server class directories (making the script references accurate) or change the script references to point to a single bin source.]]


This seems a little messy to me but I haven't come up with any other ideas.


Splunk Employee
Splunk Employee

Since your requirements are to have different configs on a per-server basis, then I would advise that you ship the Splunk_TA_nix with the inputs disabled and then use your separate/existing server classes to enable the inputs selectively.

Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...