Getting Data In

Combining input.conf files for the same app in different data centers

damonmanni
Path Finder

Currently I deploy an app for Oracle log files on servers located in DC1 as such:
deploy svr> /opt/splunk/etc/deployment-apps/dc1_oracledb_inputs

And then I also deploy an app for Oracle log files on servres located in DC2 as such:
deploy svr> /opt/splunk/etc/deployment-apps/dc2_oracledb_inputs

This now means that I have 2 specific stanza's in my serverclass.conf file whitelisting specific servers found in that DC of choice as such:
[serverClass:dc1_oracledb]
whitelist.0 = mdc1dpm001
[serverClass:dc1_oracledb:app:dc1_oracledb_inputs]

[serverClass:dc2_oracledb]
whitelist.0 = mdc2dpm001
[serverClass:dc2_oracledb:app:dc2_oracledb_inputs]

My question is:
can I combine these 2 stanzas into 1 stanza with the new inputs.conf now containing both log file path entries found from each - as some of the log file paths will only exist/are relative on certain svrs related to their DCx/physical location?

I though that if I combine the entries from each individual inputs.conf into 1 inputs.conf - does Splunk look thru the new inputs.conf, and ignore any dir paths that are not found on the client? Or will the above idea cause unnecessary overhead on splunkd thus affecting performance?

Currently it is time consuming to create/manage yet another deployment app based on only a few small diffs from another similar app inputs.conf file.

Apologies in advance, if my question is not clear.

cheers,
Damon

Tags (2)
0 Karma

woodcock
Esteemed Legend

This will be fine and not cause any problem or overhead for Splunk. It will take a trivial effort for Splunk to determine that the directory does not exist on the server so don't worry about that.

0 Karma

kristian_kolb
Ultra Champion

I should say that it is probably not a problem to send out the same inputs.conf based on a small difference in the amount of files being monitored. Just ensure that sourcetype and index are the same for hosts in the different DCs (as that is something that is good to put in inputs.conf).

Perhaps if you posted the actual inputs.conf files you could get better help.

0 Karma
Get Updates on the Splunk Community!

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk ITSI & Correlated Network Visibility

  Now On Demand   Take Your Network Visibility to the Next Level In today’s complex IT environments, ...