Getting Data In

How can I have multiple apps hosts and inputs consolidated into single serverclass.conf & inputs.conf.dist?

newbie2tech
Communicator

Hi Team,

We have a cluster which has multiple apps under it. I am working on boarding the apps logs onto splunk.

So far we have been using individual apps which had their own serverclass.conf and inputs.conf.dist,index and role and we built it that way since now we are consolidating all the apps in a cluster to utilize same index and roles but have different hosts/inputs .

Question - How can i have hosts and inputs of the 2 apps[ hosts n inputs are completely different] specified in single serverclass.conf and inputs.conf.dist? does it have to be different stanzas or something along those lines?

Probably I can whitelist all hosts under serverclass.conf and all inputs in inputs.conf.dist and they get pushed out such that all the hosts [app1 & app2] will have all the configs [app1+app2], but this does not look efficient and I believe there is a better way to do it.

In our splunk environment deployment is automated i.e. by deployment server, separate deployers for search head cluster and indexer cluster.

Any guidance is appreciated, thanks in advance.

Please let me know if more details are needed.

 App1
    host1-app1.com
    host2-app1.com

    /app/services/weblog.log
    /app/services/weberror.log


    App2
    host1-app2.com
    host2-app2.com

    /app/dyn/system.log
    /app/dyn/systemerror.log
0 Karma
1 Solution

pradeepkumarg
Influencer

Yes, you can use one serverclass.conf and create multiple server classes. Each stanza is a separate server class

Example below

[serverClass:My_App1]
restartSplunkd = true
whitelist.0=host1
whitelist.1=host2
whitelist.2=host3
[serverClass:My_App1:app:my_inputs_1]

[serverClass:My_App2]
restartSplunkd = true
whitelist.0=host5
whitelist.1=host6
[serverClass:My_App2:app:my_inputs_2] 

View solution in original post

0 Karma

pradeepkumarg
Influencer

Yes, you can use one serverclass.conf and create multiple server classes. Each stanza is a separate server class

Example below

[serverClass:My_App1]
restartSplunkd = true
whitelist.0=host1
whitelist.1=host2
whitelist.2=host3
[serverClass:My_App1:app:my_inputs_1]

[serverClass:My_App2]
restartSplunkd = true
whitelist.0=host5
whitelist.1=host6
[serverClass:My_App2:app:my_inputs_2] 
0 Karma

newbie2tech
Communicator

Thanks Pradeep, i had used something similar!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...