Getting Data In

Best way to change the inputs.conf file of a universal forwarder from deployment server.

Communicator

Can any one please let me know the best way to update the opt/splunkforwarder/etc/system/local/inputs.conf of universal forwarder from a deployment server. I'm able to achieve this by creating an app called local in deployment server but Is there any better way to do this ?

0 Karma

Champion

If you have configured your Deployment Server correctly and you have an app called myfirstapp.
Here is a sample serverclass.conf:

Defaults for app repository on Deployment server: $SPLUNK_HOME\etc\deployment-apps

Default for install location on client server: $SPLUNK_HOME\etc\apps


#serverclass.conf
#default deployment server settings
[global]
repositoryLocation=$SPLUNK/etc/deployment-apps #repository of your apps you wish to deploy
restartSplunkd=false
restartSplunkWeb=false
stateOnClient=disabled #all apps are disable unless stated at higher precede stanza
blacklist.0=* # all server are blacklisted unless stated at higher precede stanza
continueMatching=true
#my forwarders class. This class will deploy all apps under this calss to any server in 10.1.251.* range
[serverClass:forwarders]
restartSplunkd=true #restart Splunkd after install
stateOnClient=enabled
whitelist.0=10.1.251.* #Range of Forwarders
#deploy myfirstapp using serverClass fowarders
#location of my firstapp: $SPLUNK_HOME\etc\deployment-apps\firstapp
[serverClass:forwarders:app:myfirstapp]

On your forwarder if not configured:


#deploymentclient.conf
[deployment-client]
Disabled=false
phoneHomeIntervalInSecs = 300
[target-broker:deploymentServer]
targetUri=:8089

To list deployment clients use: splunk list deploy-clients

Additional reading:

http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/ConfigureDeploymentClients

http://docs.splunk.com/Documentation/Splunk/5.0/Admin/Serverclassconf

http://wiki.splunk.com/Deploy:DeploymentServer

Hope this helps.

0 Karma

Champion

Give me a moment and I'll have a sample config.

0 Karma

Communicator

I'm looking for a way to deploy it as an app itself

0 Karma

Communicator

Yes, but the issue is I do have a serverclass.conf file that is set to deploy in to opt/splunkforwarder/etc/system/local directory instead of apps.

0 Karma

Champion

Have you configured your Deployment server? Is your UF configured to contact said Deployment Server?

0 Karma