Which configuration file matters where in a distributed Splunk installation?

[mghocke]

Hi everybody,

I am trying to gain understanding on what configuration file matters to be where in a Splunk installation. I have a search head cluster, an indexer cluster, tons of universal forwarders, and a handful of heavy forwarders. Of the almost 60 .conf files in 6.5.x where do each of these have to be located? Search head, indexer, and/or forwarder? I am asking this question from a developer point of view in order to get the instructions right and also to understand the installation better. Is there some documentation on this out there?

Thanks!

--- Michael

[ddrillic]

From my perceptive, applying changes to the universal forwarders, is the most time consuming part of my work. The serverclass.conf is the sacred file ; -)

Deploy apps to clients

[alacercogitatus · Accepted solution]

That is a loaded question. Fully documented here: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles . I'm not sure what you mean by developer point of view, do you refer to Splunk App Development? There are more common files that are in use, not all of them need used in most instances. There are also conditions on when each file might go to a different Splunk instance. I highly recommend you take the Free Splunk Fundamentals (https://www.splunk.com/view/SP-CAAAPX9) course for a base understanding of what Splunk is and how it works at a higher level.

[mghocke]

Thank you so much for answering. I think I found the page in the documentation that is relevant to my question: https://docs.splunk.com/Documentation/Splunk/6.6.1/Admin/Configurationparametersandthedatapipeline

I just wanted to know which parts of the configuration is needed on what tier of Splunk. I have a multi-tenancy setup and there are a few apps and add-ons that I need to modify in order to make sure they don't step on everybody's feet. So, I go through them and understand what they do and how they do it and modify them by, sometimes, erasing certain configuration files that are not needed on that specific tier. For example, I don't need an indexes.conf file on a search head nor do I usually need inputs.conf on an indexer. Some files, like props.conf and transforms.conf are needed everywhere because they do search-time or index-time transformations and extractions.