Getting Data In

Multiple Unix monitoring - How to do Splunk TA Nix distribution?

GaetanVP
Contributor

Hello Splunkers !

Context : I want to deploy Splunk conf to monitor Unix system logs.
Let's suppose I have two groups of servers (group A and group B) and I want to monitor different folders/files depending on the groupe of server.

For that use case I would be temped to use the official Splunk Nix TA app and a Deployment Server to distribute the app.
The thing is I cannot deployed the same TA on the two groups since I want to configure different local/inputs.conf depending on the server's group.

How would you do that ? My idea was to deploy the Splunk TA Nix without modification (no edit of local/* files) and create two other different apps with only the configuration on inputs for the necessary group.

At the end I would end up with :
- Servers of group A : default Splunk TA Nix + Custom app for inputs A
- Servers of group B : default Splunk TA Nix + Custom app for inputs B

What do you think of this approach ?

Thanks,
GaetanVP

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @GaetanVP,

it's the same I'd use.

if some input error in _internal don't disturb you and the folders to monitor aren't also present in the other server group, you could create only one custom app, containing both your custom input and deploy it to both the server groups.

Ciao.

Giuseppe

GaetanVP
Contributor

Hello @gcusello thanks for your answer,

Okok I will deployed the base Nix app and a custom one for each group.

Thanks !
GaetanVP 

isoutamo
SplunkTrust
SplunkTrust
There was on Splunk Slack just a discussion about this problematic https://splunk-usergroups.slack.com/archives/C77SVATMZ/p1691397606241949.
I that this base TA + local TA is normal way to do it. Just check that you name those so that you have correct precedence if/when needed (use btool to check if needed).
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...