Getting Data In

How to distribute the configuration bundle of inputs.conf to an indexer cluster?

Path Finder
[default]
host = cmgr1.splunk.hq1.xxx.com

[splunktcp://9997]
connection_host = ip

I'm trying to deploy a very simple inputs.conf via the Distribution Configuration Bundle. I was able to deploy my indexes.conf file, and the process was pretty simple.

However, when I try to deploy the above, it does NOT work.

Question:
I do not understand how the part will propagate. Will it know how to change that host to what the host actually is? I have 5 indexers with different host names. Will it change them to the proper host name for each?

[default]
host = cmgr1.splunk.hq1.xxx.com

Am I doing this right? Is there a better / proper way to deploy the inputs.conf across my indexers so as to receive logs?

1 Solution

Influencer

Actually the inputs.conf you want to distribute is just:

 [splunktcp://9997]
 connection_host = ip

When you install and accept the license to Splunk on each of your cluster-slaves / indexers, it'll setup an SPLUNK_HOME/etc/system/local/inputs.conf that defines:

[default]
host = (hostname)

So when Splunk puts the configuration together according to the precedence rules, it'll get the splunktcp stanza that you push from the cluster master, and the default host from the system/local copy on each indexer.

View solution in original post

Influencer

Actually the inputs.conf you want to distribute is just:

 [splunktcp://9997]
 connection_host = ip

When you install and accept the license to Splunk on each of your cluster-slaves / indexers, it'll setup an SPLUNK_HOME/etc/system/local/inputs.conf that defines:

[default]
host = (hostname)

So when Splunk puts the configuration together according to the precedence rules, it'll get the splunktcp stanza that you push from the cluster master, and the default host from the system/local copy on each indexer.

View solution in original post

Path Finder

This worked perfect! Thank you!!

0 Karma

Communicator

Helped me too. Thanks!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!