Getting Data In
Highlighted

Is it possible to modify inputs.conf on our Windows universal forwarders via serverclass.conf using the deployment server?

New Member

Hi,

I am trying to manage the universal forwarders on all our Windows system using the deployment server. They all have the same app (splunkTAwindows) but the inputs.conf are all different on each server. Is it possible to manage this via serverclass.conf?

For example:

server 1 inputs.conf:

[WinEventLog://Application]
disabled = 0
startfrom = oldest
current
only = 0
index = main
host =develop

server 2 inputs.conf:

[WinEventLog://Application]
disabled = 0
startfrom = oldest
current
only = 0
index = main
host =staging

Thanks,
Milan

0 Karma
Highlighted

Re: Is it possible to modify inputs.conf on our Windows universal forwarders via serverclass.conf using the deployment server?

Esteemed Legend

I would create a "splunkTAWindows_hostoverride" app and use IP-based stanzas in props.conf to override the hosts as necessary after the fact.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.