Getting Data In

Full blow instances of apps on Universal Forwarders?

Engager

I have been reading link:Splunk 4.2 Universal Forwarder *nix

Why does a universal forwarder need the entire *nix application, isn't the

3 - Copy /splunk/etc/apps/unix/default/app.conf to /splunk/etc/apps/unix/local/app.conf

4 - Edit the app.conf in the local directory to say: app=enabled

5 - Copy /splunk/etc/apps/unix/default/inputs.conf to /splunk/etc/apps/unix/local/

enough and then the rest of the app's directories can be deleted?

Tags (2)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

The determination of which parts of an app are necessary can be found here:

http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F

When you look at that, you'll see that the UF is working against the "input" phase only. However, there are a few items that could occur within that phase:

- inputs.conf
- props.conf
  - sourcetype
  - CHARSET
  - NO_BINARY_CHECK
  - CHECK_METHOD
- wmi.conf
- regmon-filters.conf

So, it really depends on the app itself. In many cases, you're correct that only the inputs.conf is necessary (you really don't even need the app.conf). My personal preference is to only put those items which are strictly necessary on the UF (i.e. what you're asking about). You just have to be sure that you know which things those are. In general, it's easier to just dump the entire app though, rather than consider what's needed.

View solution in original post

Splunk Employee
Splunk Employee

The determination of which parts of an app are necessary can be found here:

http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F

When you look at that, you'll see that the UF is working against the "input" phase only. However, there are a few items that could occur within that phase:

- inputs.conf
- props.conf
  - sourcetype
  - CHARSET
  - NO_BINARY_CHECK
  - CHECK_METHOD
- wmi.conf
- regmon-filters.conf

So, it really depends on the app itself. In many cases, you're correct that only the inputs.conf is necessary (you really don't even need the app.conf). My personal preference is to only put those items which are strictly necessary on the UF (i.e. what you're asking about). You just have to be sure that you know which things those are. In general, it's easier to just dump the entire app though, rather than consider what's needed.

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!