Full blow instances of apps on Universal Forwarders?

[byronschwab]

I have been reading link:Splunk 4.2 Universal Forwarder *nix

Why does a universal forwarder need the entire *nix application, isn't the

3 - Copy /splunk/etc/apps/unix/default/app.conf to /splunk/etc/apps/unix/local/app.conf

4 - Edit the app.conf in the local directory to say: app=enabled

5 - Copy /splunk/etc/apps/unix/default/inputs.conf to /splunk/etc/apps/unix/local/

enough and then the rest of the app's directories can be deleted?

[mw · Accepted solution]

The determination of which parts of an app are necessary can be found here:

http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F

When you look at that, you'll see that the UF is working against the "input" phase only. However, there are a few items that could occur within that phase:

- inputs.conf
- props.conf
  - sourcetype
  - CHARSET
  - NO_BINARY_CHECK
  - CHECK_METHOD
- wmi.conf
- regmon-filters.conf

So, it really depends on the app itself. In many cases, you're correct that only the inputs.conf is necessary (you really don't even need the app.conf). My personal preference is to only put those items which are strictly necessary on the UF (i.e. what you're asking about). You just have to be sure that you know which things those are. In general, it's easier to just dump the entire app though, rather than consider what's needed.