We have one host where one of the inputs in an app distributed by the Deployment Server is causing too much traffic.
As the App is distributed by the DS, is there any way of disabling a specific input on a specific server? (or server class)
You can obviously blacklist the host for the entire app - but the rest of the app is providing data we need, just one input is causing an issue.
I see three options:
disabled=1
and give that app a name such that it will take precedence over the original app. Then push this new app to the particular server (in addition to the original app). This should allow you to override the status of that particular monitor input, without having to create a complete parallel version of the app.I see three options:
disabled=1
and give that app a name such that it will take precedence over the original app. Then push this new app to the particular server (in addition to the original app). This should allow you to override the status of that particular monitor input, without having to create a complete parallel version of the app.Had similar ideas, with 2) being the most logical. We use Puppet so 3) could be an option, but I don't like two independent systems fighting over control.
I was hoping there was an easier native Splunk DS method but it looks like option 2) is closest to that.
You can disable the monitor inside the app. disabled=1. But this will disable the monitor for all the hosts that are getting this app. your best bet would be create another version of this app with the monitor disabled and create a new server class with just the host in question and target the new version of the app.