Getting Data In

How to distribute the configuration bundle of inputs.conf to an indexer cluster?

shandman
Path Finder
[default]
host = cmgr1.splunk.hq1.xxx.com

[splunktcp://9997]
connection_host = ip

I'm trying to deploy a very simple inputs.conf via the Distribution Configuration Bundle. I was able to deploy my indexes.conf file, and the process was pretty simple.

However, when I try to deploy the above, it does NOT work.

Question:
I do not understand how the part will propagate. Will it know how to change that host to what the host actually is? I have 5 indexers with different host names. Will it change them to the proper host name for each?

[default]
host = cmgr1.splunk.hq1.xxx.com

Am I doing this right? Is there a better / proper way to deploy the inputs.conf across my indexers so as to receive logs?

1 Solution

acharlieh
Influencer

Actually the inputs.conf you want to distribute is just:

 [splunktcp://9997]
 connection_host = ip

When you install and accept the license to Splunk on each of your cluster-slaves / indexers, it'll setup an SPLUNK_HOME/etc/system/local/inputs.conf that defines:

[default]
host = (hostname)

So when Splunk puts the configuration together according to the precedence rules, it'll get the splunktcp stanza that you push from the cluster master, and the default host from the system/local copy on each indexer.

View solution in original post

acharlieh
Influencer

Actually the inputs.conf you want to distribute is just:

 [splunktcp://9997]
 connection_host = ip

When you install and accept the license to Splunk on each of your cluster-slaves / indexers, it'll setup an SPLUNK_HOME/etc/system/local/inputs.conf that defines:

[default]
host = (hostname)

So when Splunk puts the configuration together according to the precedence rules, it'll get the splunktcp stanza that you push from the cluster master, and the default host from the system/local copy on each indexer.

shandman
Path Finder

This worked perfect! Thank you!!

0 Karma

napomokoetle
Communicator

Helped me too. Thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...