We have a cluster which has multiple apps under it. I am working on boarding the apps logs onto splunk.
So far we have been using individual apps which had their own serverclass.conf and inputs.conf.dist,index and role and we built it that way since now we are consolidating all the apps in a cluster to utilize same index and roles but have different hosts/inputs .
Question - How can i have hosts and inputs of the 2 apps[ hosts n inputs are completely different] specified in single serverclass.conf and inputs.conf.dist? does it have to be different stanzas or something along those lines?
Probably I can whitelist all hosts under serverclass.conf and all inputs in inputs.conf.dist and they get pushed out such that all the hosts [app1 & app2] will have all the configs [app1+app2], but this does not look efficient and I believe there is a better way to do it.
In our splunk environment deployment is automated i.e. by deployment server, separate deployers for search head cluster and indexer cluster.