Getting Data In

Deploy $SPLUNK_HOME/etc/log.cfg via deployment server?

ftk
Motivator

Is it possible to deploy $SPLUNK_HOME/etc/log.cfg via the deployment server to my forwarders? I wish to reduce the footprint of my Lightweight Forwarders by reducing the log sizes as mentioned here: http://www.splunk.com/wiki/Community:MinimizingForwarderFootprint

I am currently handling this at initial Splunk installation time, however would prefer to offload this on to the Splunk deployment server.

1 Solution

jrodman
Splunk Employee
Splunk Employee

Deployment server doesn't really do this, and the logging framework has to work before the bundle code starts up. I mean sure some chicken-and-egg engineering could be done with a bootstrap mode and a later runtime mode, but it's not a high payoff area compared to some others right now.

please do hit up support email with an Enhancement Request about that this matters to you folks. It gets raised now and then but I don't know if it gets through to product management.

View solution in original post

dstaulcu
Builder

dcparker
Path Finder

did you ever get this solved?

0 Karma

Jason
Motivator

You could hack up deployment server to deploy to etc, but it only deploys "apps" and you probably wouldn't be able to deploy the exact file etc/log.cfg. Perhaps etc/something/local/log.cfg, but then Splunk wouldn't pick it up.

You could try symlinking etc/log.cfg to somewhere inside an app in etc/apps, then deploy that with DS, making sure to restart Splunk upon app install. That might work, but you would have to manage the symlink somehow.

0 Karma

jrodman
Splunk Employee
Splunk Employee

Deployment server doesn't really do this, and the logging framework has to work before the bundle code starts up. I mean sure some chicken-and-egg engineering could be done with a bootstrap mode and a later runtime mode, but it's not a high payoff area compared to some others right now.

please do hit up support email with an Enhancement Request about that this matters to you folks. It gets raised now and then but I don't know if it gets through to product management.

Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...