I want to deploy an apps to all forwarder and each forwarder will monitor a specific directory based on environment variable. How to do this?

[daniel_splunk]

We have four servers "hostA" through "hostD" which share a common network storage area for log files. Each server has a universal forwarder installed.

Log files within shared storage are named using the short name of the host.

For example,
/shared/hostA_file1.log
/shared/hostB_file2.log

I want to deploy just one app to all forwarder and each forwarder will monitor a specific directory based on environment variable.

I write the inputs.conf like this but not working.

[monitor:///shared/$HOSTNAME_*.log]

[daniel_splunk]

You can set the same variable to your splunk ac environment variable (eg. .bashrc and .bash_profile) to try also.

[gschmitz]

Would that help in my case? I think in some settings Splunk just doesn't do the substitution 😞

[gschmitz]

Hi,
I googled for splunk-launch questions and found this post.
I tried to set a variable (the fully qualified domain name and the hostname to be precise), but inputs.conf sets the server name to the literal variable:
Failed to parse timestamp. Defaulting to timestamp of previous event (Tue Feb 3 09:06:35 2015). Context: source::/home/splidx01/var/log/splunk/splunkd_stderr.log|host::$SHORTNAME|splunkd_stderr|41

Same goes for the register_replication_address. Master says
ERROR ClusterMasterPeerHandler - Invalid host name $FQDN

What exactly limits the use of these variables? sslKeysfile in the same file takes the variable just fine...

[daniel_splunk]

Splunk don't like the underscore in variable substitution.

You can change the directory structure like this.

/shared/hostA/file1.log
/shared/hostB/file2.log

and the monitoring stanza become.

[monitor:///shared/$HOSTNAME/*.log]

For the environment, you need to set it under
$SPLUNK_HOME/etc/splunk-launch.conf

Set the environment variable from the shell level won't work as Splunk won't read that.