Getting Data In

Deployment Server and Universal Forwarder- Which file is being monitored?

phularah
Communicator

I saw a question on the internet while searching for answers for a separate question and a few comments below regarding the correct answer for that. Now, I am confused as to what  should have been the correct answer. This was the question.


This file has been manually created on a universal forwarder:

/opt/splunkforwarder/etc/apps/my_TA/local/inputs.conf
[monitor:///var/log/messages]
sourcetype=syslog
index=syslog

A new Splunk admin comes in and connects the universal forwarders to a deployment server and deploys the same app with a new inputs.conf file:

/opt/splunk/etc/deployment-apps/my_TA/local/inputs.conf
[monitor:///var/log/maillog]
sourcetype=maillog
index=syslog

Which file is now monitored?
/var/log/maillog or both /var/log/maillog and /var/log/messages

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @phularah,

when you connect a client to a Deployment Server, all the local apps will be removed and the apps for the ServerClass containing that client will be deployed.

So if the local inputs.conf is in an app (as it seems from your information), it will be removed.

If you want to monitor both the folders, you have to insert the local stanza in the deployed app.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @phularah,

when you connect a client to a Deployment Server, all the local apps will be removed and the apps for the ServerClass containing that client will be deployed.

So if the local inputs.conf is in an app (as it seems from your information), it will be removed.

If you want to monitor both the folders, you have to insert the local stanza in the deployed app.

Ciao.

Giuseppe

isoutamo
SplunkTrust
SplunkTrust

Hi

it's just like @gcusello said. When the app name is same (installed into same path) then DS win. You could also check it with btool on UF side. Just 

splunk btool inputs list monitor:///var/log --debug

and then look the output which shows all monitored files under /var/log

r. Ismo

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...