Can we have multiple inputs.conf

[dsenapaty]

Hello All,

I am pretty new to splunk and still learning day by day. I have a question...In my organisation we have a ton of jboss servers and we are planning to do centralized logging for all of them with each application names as index names. I want to manage all these within deployment server...Instead of creating one app for all applications i want to create a single app for jboss logs  with inputs and outputs deployed from deployment server. Now how can i handle that multiple index issue that i have. Does splunk allow the use of two different inputs.conf....

I was planning to have an inputs.conf created under the etc/system/local with just the value index=app1 and leave the deployment server to take care of jboss logs monitoring. Will this work???

Please suggest me ideas...

[s2_splunk]

I recommend never putting anything under system/local that doesn't need to be there, because those settings will be out of reach for the deployment server/client.

Best practice is to create your org's configuration in apps in a meaningful way and assign those apps to the systems that need it. For example, you'd have a org_fwdr_outputs app that contains all conf files needed for data forwarding to indexers and map that to all your endpoint hosts. You could similarily create an app for your JBoss logs, e.g. org_jboss_logs or sth like that and deploy that to hosts that run JBoss. It is very worthwhile spending some time thinking about groups of things to simplify your serverclass.conf file such that you don't end up with an unmanageable mayhem of host groups and apps.

Every app can have it's own set of conf files that will override the system defaults. I strongly recommend studying this part of the documentation until you fully understand how the this conf system works.

HTH!