Can any one please let me know the best way to update the opt/splunkforwarder/etc/system/local/inputs.conf of universal forwarder from a deployment server. I'm able to achieve this by creating an app called local in deployment server but Is there any better way to do this ?
If you have configured your Deployment Server correctly and you have an app called myfirstapp.
Here is a sample serverclass.conf:
Defaults for app repository on Deployment server: $SPLUNK_HOME\etc\deployment-apps
Default for install location on client server: $SPLUNK_HOME\etc\apps
#default deployment server settings
repositoryLocation=$SPLUNK/etc/deployment-apps #repository of your apps you wish to deploy
stateOnClient=disabled #all apps are disable unless stated at higher precede stanza
blacklist.0=* # all server are blacklisted unless stated at higher precede stanza
#my forwarders class. This class will deploy all apps under this calss to any server in 10.1.251.* range
restartSplunkd=true #restart Splunkd after install
whitelist.0=10.1.251.* #Range of Forwarders
#deploy myfirstapp using serverClass fowarders
#location of my firstapp: $SPLUNK_HOME\etc\deployment-apps\firstapp
On your forwarder if not configured:
phoneHomeIntervalInSecs = 300
To list deployment clients use: splunk list deploy-clients
Hope this helps.