Getting Data In

How to distribute the configuration bundle of inputs.conf to an indexer cluster?

shandman
Path Finder
[default]
host = cmgr1.splunk.hq1.xxx.com

[splunktcp://9997]
connection_host = ip

I'm trying to deploy a very simple inputs.conf via the Distribution Configuration Bundle. I was able to deploy my indexes.conf file, and the process was pretty simple.

However, when I try to deploy the above, it does NOT work.

Question:
I do not understand how the part will propagate. Will it know how to change that host to what the host actually is? I have 5 indexers with different host names. Will it change them to the proper host name for each?

[default]
host = cmgr1.splunk.hq1.xxx.com

Am I doing this right? Is there a better / proper way to deploy the inputs.conf across my indexers so as to receive logs?

1 Solution

acharlieh
Influencer

Actually the inputs.conf you want to distribute is just:

 [splunktcp://9997]
 connection_host = ip

When you install and accept the license to Splunk on each of your cluster-slaves / indexers, it'll setup an SPLUNK_HOME/etc/system/local/inputs.conf that defines:

[default]
host = (hostname)

So when Splunk puts the configuration together according to the precedence rules, it'll get the splunktcp stanza that you push from the cluster master, and the default host from the system/local copy on each indexer.

View solution in original post

acharlieh
Influencer

Actually the inputs.conf you want to distribute is just:

 [splunktcp://9997]
 connection_host = ip

When you install and accept the license to Splunk on each of your cluster-slaves / indexers, it'll setup an SPLUNK_HOME/etc/system/local/inputs.conf that defines:

[default]
host = (hostname)

So when Splunk puts the configuration together according to the precedence rules, it'll get the splunktcp stanza that you push from the cluster master, and the default host from the system/local copy on each indexer.

shandman
Path Finder

This worked perfect! Thank you!!

0 Karma

napomokoetle
Communicator

Helped me too. Thanks!

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...