Getting Data In

Conditional Input.conf setting?

daniel333
Builder

All, 

I have about 200 machines with UF installed. I want to monitor bash_history and a few other Linux /home items. The challenge is on about half the machines the home directory is an NFS mount and the other half are local file system.  Monitoring the NFS every every end point is IO prohibitive and double indexes the same data. 

Is there a way in Splunk to programmatically handle this? That is, I only need to gather the files/logs from one host if it's mounted from NFS but if it's local file system I need to run the input on each machine. 

Any recommendations? I was thinking of writing a script input in a Splunk app that creates and manages an app in the UF app folder. But seems very clunky. 

Labels (1)
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are not programmatic settings in inputs.conf or any other Splunk config file.

If you use a third-part tool like Ansible to manage your UFs then your script idea might work  It would be even better if Ansible could make the NFS-is-used decision and selectively install your input app.

If you use the Splunk deployment server to manage UFs then don't manipulate the app locally.  That will cause the UF to re-install the app from the DS.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...