Getting Data In

Can we have multiple inputs.conf

dsenapaty
Explorer

Hello All,

I am pretty new to splunk and still learning day by day. I have a question...In my organisation we have a ton of jboss servers and we are planning to do centralized logging for all of them with each application names as index names. I want to manage all these within deployment server...Instead of creating one app for all applications i want to create a single app for jboss logs  with inputs and outputs deployed from deployment server. Now how can i handle that multiple index issue that i have. Does splunk allow the use of two different inputs.conf....

 

I was planning to have an inputs.conf created under the etc/system/local with just the value index=app1 and leave the deployment server to take care of jboss logs monitoring. Will this work???

 

Please suggest me ideas...

Labels (2)
0 Karma

s2_splunk
Splunk Employee
Splunk Employee

I recommend never putting anything under system/local that doesn't need to be there, because those settings will be out of reach for the deployment server/client.

Best practice is to create your org's configuration in apps in a meaningful way and assign those apps to the systems that need it. For example, you'd have a org_fwdr_outputs app that contains all conf files needed for data forwarding to indexers and map that to all your endpoint hosts. You could similarily create an app for your JBoss logs, e.g. org_jboss_logs or sth like that and deploy that to hosts that run JBoss. It is very worthwhile spending some time thinking about groups of things to simplify your serverclass.conf file such that you don't end up with an unmanageable mayhem of host groups and apps.

Every app can have it's own set of conf files that will override the system defaults. I strongly recommend studying this part of the documentation until you fully understand how the this conf system works.

HTH!

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...