Getting Data In

Deployment server to forwarder communication

Communicator

Hi,

I already create inputs.conf file in splunk_home/system/local/ folder and now i want to override this changes from deployment server. Is this possible ?

0 Karma

Super Champion

No, not without creating a file manipulation script and sending that, and even then it is problematic.

0 Karma

Builder

I am thankful we specified a DNS alias for our deployment server name when we deployed our universal forwarders. Having done so allows make changes centrally (in DNS or on SLB) in order to re-route deployment-clients to alternate deployment-servers over time.

0 Karma

Super Champion

The deploymentclient.conf and outputs.conf typically are placed in the system\local folder because once set they are rarely changed. However, if you need to manage them, then you can move them after the install - they are created by the install and placed in the system\local folder. It is important that you move these configurations and not leave a copy in the system\local folder because system\local has the highest priority for these settings.

0 Karma

Communicator

Many Many Thanks,

As a best practice, we should not have to create any conf files in system folder if we want to manage that files from deployment server. This same apply for deploymentclient.conf and outputs.conf.

Please correct me if somewhere i am wrong.

0 Karma

Super Champion

Once it has been deployed to all of the servers, and the servers have restarted the splunk service, then you can delete the app from the deployment apps folder and it will be removed from all of the servers. And, the new app you created with the script can be managed by the deployment server.
Just so you know, there are a great many things can go wrong with this if you don't know what you're doing.

0 Karma

Super Champion

It sounds like your problem is you have an inputs.conf in the system folder, and in order to maintain it with the deployment server it needs to be in the apps folder.
If it is just a few servers, then I'd do this by hand.
If you want to do it with a script, then create a script on one of the servers that will create a new app folder for this input, and move the inputs.conf from the system folder into the new app folder.
Once you've tested it, the create an app in the deployment apps folder, put the script in the app's bin folder, and create an input.conf that runs the script once at startup.

0 Karma

Communicator

Thanks for quick response.

I am seeing both inputs.conf monitoring files.

How should i create manipulation script ?

Please let me know correct route to solve this problem.

0 Karma