Getting Data In

Conditional Input.conf setting?

daniel333
Builder

All, 

I have about 200 machines with UF installed. I want to monitor bash_history and a few other Linux /home items. The challenge is on about half the machines the home directory is an NFS mount and the other half are local file system.  Monitoring the NFS every every end point is IO prohibitive and double indexes the same data. 

Is there a way in Splunk to programmatically handle this? That is, I only need to gather the files/logs from one host if it's mounted from NFS but if it's local file system I need to run the input on each machine. 

Any recommendations? I was thinking of writing a script input in a Splunk app that creates and manages an app in the UF app folder. But seems very clunky. 

Labels (1)
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are not programmatic settings in inputs.conf or any other Splunk config file.

If you use a third-part tool like Ansible to manage your UFs then your script idea might work  It would be even better if Ansible could make the NFS-is-used decision and selectively install your input app.

If you use the Splunk deployment server to manage UFs then don't manipulate the app locally.  That will cause the UF to re-install the app from the DS.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...