Deployment Server and Universal Forwarder- Which file is being monitored?

[phularah]

I saw a question on the internet while searching for answers for a separate question and a few comments below regarding the correct answer for that. Now, I am confused as to what  should have been the correct answer. This was the question.

This file has been manually created on a universal forwarder:

/opt/splunkforwarder/etc/apps/my_TA/local/inputs.conf
[monitor:///var/log/messages]
sourcetype=syslog
index=syslog

A new Splunk admin comes in and connects the universal forwarders to a deployment server and deploys the same app with a new inputs.conf file:

/opt/splunk/etc/deployment-apps/my_TA/local/inputs.conf
[monitor:///var/log/maillog]
sourcetype=maillog
index=syslog

Which file is now monitored?
/var/log/maillog or both /var/log/maillog and /var/log/messages

[gcusello · Accepted solution]

Hi @phularah,

when you connect a client to a Deployment Server, all the local apps will be removed and the apps for the ServerClass containing that client will be deployed.

So if the local inputs.conf is in an app (as it seems from your information), it will be removed.

If you want to monitor both the folders, you have to insert the local stanza in the deployed app.

Ciao.

Giuseppe

[isoutamo]

Hi

it's just like @gcusello said. When the app name is same (installed into same path) then DS win. You could also check it with btool on UF side. Just 

splunk btool inputs list monitor:///var/log --debug

and then look the output which shows all monitored files under /var/log

r. Ismo