How can I have multiple apps hosts and inputs consolidated into single serverclass.conf & inputs.conf.dist?

[newbie2tech]

Hi Team,

We have a cluster which has multiple apps under it. I am working on boarding the apps logs onto splunk.

So far we have been using individual apps which had their own serverclass.conf and inputs.conf.dist,index and role and we built it that way since now we are consolidating all the apps in a cluster to utilize same index and roles but have different hosts/inputs .

Question - How can i have hosts and inputs of the 2 apps[ hosts n inputs are completely different] specified in single serverclass.conf and inputs.conf.dist? does it have to be different stanzas or something along those lines?

Probably I can whitelist all hosts under serverclass.conf and all inputs in inputs.conf.dist and they get pushed out such that all the hosts [app1 & app2] will have all the configs [app1+app2], but this does not look efficient and I believe there is a better way to do it.

In our splunk environment deployment is automated i.e. by deployment server, separate deployers for search head cluster and indexer cluster.

Any guidance is appreciated, thanks in advance.

Please let me know if more details are needed.

 App1
    host1-app1.com
    host2-app1.com

    /app/services/weblog.log
    /app/services/weberror.log


    App2
    host1-app2.com
    host2-app2.com

    /app/dyn/system.log
    /app/dyn/systemerror.log

[pradeepkumarg · Accepted solution]

Yes, you can use one serverclass.conf and create multiple server classes. Each stanza is a separate server class

Example below

[serverClass:My_App1]
restartSplunkd = true
whitelist.0=host1
whitelist.1=host2
whitelist.2=host3
[serverClass:My_App1:app:my_inputs_1]

[serverClass:My_App2]
restartSplunkd = true
whitelist.0=host5
whitelist.1=host6
[serverClass:My_App2:app:my_inputs_2] 

[newbie2tech]

Thanks Pradeep, i had used something similar!