Getting Data In

Can we have multiple inputs.conf

dsenapaty
Explorer

Hello All,

I am pretty new to splunk and still learning day by day. I have a question...In my organisation we have a ton of jboss servers and we are planning to do centralized logging for all of them with each application names as index names. I want to manage all these within deployment server...Instead of creating one app for all applications i want to create a single app for jboss logs  with inputs and outputs deployed from deployment server. Now how can i handle that multiple index issue that i have. Does splunk allow the use of two different inputs.conf....

 

I was planning to have an inputs.conf created under the etc/system/local with just the value index=app1 and leave the deployment server to take care of jboss logs monitoring. Will this work???

 

Please suggest me ideas...

Labels (2)
0 Karma

s2_splunk
Splunk Employee
Splunk Employee

I recommend never putting anything under system/local that doesn't need to be there, because those settings will be out of reach for the deployment server/client.

Best practice is to create your org's configuration in apps in a meaningful way and assign those apps to the systems that need it. For example, you'd have a org_fwdr_outputs app that contains all conf files needed for data forwarding to indexers and map that to all your endpoint hosts. You could similarily create an app for your JBoss logs, e.g. org_jboss_logs or sth like that and deploy that to hosts that run JBoss. It is very worthwhile spending some time thinking about groups of things to simplify your serverclass.conf file such that you don't end up with an unmanageable mayhem of host groups and apps.

Every app can have it's own set of conf files that will override the system defaults. I strongly recommend studying this part of the documentation until you fully understand how the this conf system works.

HTH!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...