Getting Data In

Conditional Input.conf setting?

daniel333
Builder

All, 

I have about 200 machines with UF installed. I want to monitor bash_history and a few other Linux /home items. The challenge is on about half the machines the home directory is an NFS mount and the other half are local file system.  Monitoring the NFS every every end point is IO prohibitive and double indexes the same data. 

Is there a way in Splunk to programmatically handle this? That is, I only need to gather the files/logs from one host if it's mounted from NFS but if it's local file system I need to run the input on each machine. 

Any recommendations? I was thinking of writing a script input in a Splunk app that creates and manages an app in the UF app folder. But seems very clunky. 

Labels (1)
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are not programmatic settings in inputs.conf or any other Splunk config file.

If you use a third-part tool like Ansible to manage your UFs then your script idea might work  It would be even better if Ansible could make the NFS-is-used decision and selectively install your input app.

If you use the Splunk deployment server to manage UFs then don't manipulate the app locally.  That will cause the UF to re-install the app from the DS.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...