How to distribute the configuration bundle of inputs.conf to an indexer cluster?

[shandman]

[default]
host = cmgr1.splunk.hq1.xxx.com

[splunktcp://9997]
connection_host = ip

I'm trying to deploy a very simple inputs.conf via the Distribution Configuration Bundle. I was able to deploy my indexes.conf file, and the process was pretty simple.

However, when I try to deploy the above, it does NOT work.

Question:
I do not understand how the part will propagate. Will it know how to change that host to what the host actually is? I have 5 indexers with different host names. Will it change them to the proper host name for each?

[default]
host = cmgr1.splunk.hq1.xxx.com

Am I doing this right? Is there a better / proper way to deploy the inputs.conf across my indexers so as to receive logs?

[acharlieh · Accepted solution]

Actually the inputs.conf you want to distribute is just:

 [splunktcp://9997]
 connection_host = ip

When you install and accept the license to Splunk on each of your cluster-slaves / indexers, it'll setup an SPLUNK_HOME/etc/system/local/inputs.conf that defines:

[default]
host = (hostname)

So when Splunk puts the configuration together according to the precedence rules, it'll get the splunktcp stanza that you push from the cluster master, and the default host from the system/local copy on each indexer.

[shandman]

This worked perfect! Thank you!!

[napomokoetle]

Helped me too. Thanks!