Minimum files and Directories for Custom TA

[mohsplunking]

Hello Splunkers,

I'm trying to push data to indexers from HF's where I have a syslog-ng receiving the logs. This is from a non-supported device therefore TA is not available on Splunkbase. My concern is when I'm writing inputs.conf can i just create one directory and call it cisco_TA and inside that create a directory called local and place my inputs.conf there ? is that sufficient to create a custom TA and transport the logs. Or should create other direcotires such as default , metadata, licenses ect..

Please if someone can advise on the above.

Thank you,

regards,

Moh.

[marycordova]

My template consists of:

• app_directory_name
  • local
    • app.conf
  • metadata
    • local.meta

app.conf

[install]
state = enabled

[ui]
is_visible = 0
label = # I usually use the exact app directory name here

[package]
check_for_updates = 0

local.meta

[]
access = read : [ * ], write : [ admin ]
export = system

[PickleRick]

Technically speaking, there is no requirement for minimum number of set of files. You could, if I remember correctly, even push an empty app (which can make sense in some scenarios).

But there are some good practices to follow.

The contents of the app look like this:

https://dev.splunk.com/enterprise/docs/developapps/createapps/appanatomy/

There are some rules of thumb when building an app (and some of them are enforced if you want to pass appinspect when vetting an app to Cloud or uploading to Splunkbase).

1. You should put your files in the default directory. The local directory is for users to overwrite the defaults (this one is not that important if you're writing just a one-off internal app but it's worth remembering)

2. There should be proper permission entries in metadata/default.meta (again - it's not that important if it's default.meta or local.meta if it's your internal app but it's good to stick to the good practices; and it's not that important if the app is running only in index time)

3. You should have app.conf describing the app (at least have the launcher section with version/description/author)

4. If you define inputs you should define them with typical parameters as default instances and set them to be disabled in default/inputs.conf. Let the user enable them selectively if needed. But if you're creating an app to just enable some inputs locally, by all means, use the local directory and create enabled inputs there.

And get a reasonable naming convention for your apps. There is nothing more annoying than having to dig through a a bunch of apps named app1, appA, myapp1, app2023, cisco_TA, TA_cisco, TA_cisco_not_working... and so on.

[dural_yyz]

Assuming you have co-located the syslog-ng app install on the same server where you have located your Splunk HF then there are a few options available to you.  You can continue to create the stand alone app to provide some experience and learning opportunities. Or...

Most people when running syslog-ng will set the destination of syslog events to a file and separated by some sort of host details.  Since the file is local to the disk then you can leverage the HF web interface to set a Data Input monitor file option and it will guide you through common event breaking, line breaking, time extraction options, and some field extraction options.  Essentially all the things a stand alone app would do but easier to manage down the road by continuing to use the web interface.

In a previous life I set the destination of the syslog-ng as a HEC receiver.  Which in your situation can be the local host HF or the IDX cluster, but that takes a bit of work and you already have a lot of development to write to file so maybe not the right idea for you.

[gcusello]

Hi @mohsplunking ,

If you use the add-on builder, it gives you also the metadata file, but you don't need other folders or files.

Obviously only if you're speaking of a normal input, if you are using a script you need also the bin folder.

If you are speaking of an add-on to install on a Search Head for pasing activities, you need also props.conf, transforms.conf and if you want the CIM compliance also eventtypes.conf and tags.conf.

Ciao.

Giuseppe