splunk Deployment server

[kholleran]

When we first rolled out Splunk, the deployment server was not used. Its been a while now & I want to move to a deployment server architecture. My question is:

Should I remove everything from etc/system/local that was put on the individual instances of Splunk or can I leave that and will the deployment apps override those?

Thanks.

Kevin

[tskinnerivsec · Accepted solution]

deployment apps will not over write the settings in etc/system/local. You may find that you have some settings configured in etc/system/local that make more sense managing with a deployed application. If that is the case, you would have to comment out the setting in etc/system/local so that the application would control the setting. I would start out deploying apps one at a time to migrate system/local settings that make sense. Then most of the apps you deploy can contain new inputs or other functionallity.

[kholleran]

That's what I was figuring but I wanted to make sure. I have basically migrated all settings for inputs/outputs/transforms/etc from conf files in /etc/system/local to their own apps to be managed, so its a matter of removing these from the conf files & syncing with the deployment server.

Thanks for your help.