Custom app creation | where to put inputs.conf and others?

[GaetanVP]

Hello Splunkers,

I have a really quick question, I want to create and push (via my DS) a fully custom Add-On (or TA... not sure how to call it) to some of my UFs.

Basically I only need a inputs.conf to monitor some log files, but I do not know if I should place it under default/ or local/ folder. 

I know that for Splunk based TA, I would have overwritten the defaults config file with my local config files, but for a custom app I don't really know. 
Should I create inputs.conf inside default/ folder but with "disabled = true" for all stanza, and overwrite it with my local inputs.conf ?

Thanks for your help,
Gaetan

[GaetanVP]

Hello @gcusello,

Thanks for your quick and clear answer, I agree with all of your points 👍

Regards,
Gaetan

[gcusello · Accepted solution]

Hi @GaetanVP,

as you well know, if you're speaking of a custom App, you can choose both the locations.

For a custom app I prefer to use default to avoid to maintain old configurations and having a better control on the deployed configuration.

About the name I prefer TA because is quicker.

About the last question, create in deault folder the inputs you need, if there are not requested inputs, I prefer to delete them or to comment them than to use disabled=true.

Ciao.

Giuseppe

[isoutamo]

Hi

as @gcusello said, basically you could put those which place you want. But as you are owner/developer of that TA then (according to instructions)  you should use default folder for those. The only exceptions are if you have any plaintext password which needs to crypt when that TA is installed on UF, then you should put those under local to get those crypted. You should put only that plaintext password to local and all other values in that stanza to default.

r. Ismo