Multiple Unix monitoring - How to do Splunk TA Nix distribution?

[GaetanVP]

Hello Splunkers !

Context : I want to deploy Splunk conf to monitor Unix system logs.
Let's suppose I have two groups of servers (group A and group B) and I want to monitor different folders/files depending on the groupe of server.

For that use case I would be temped to use the official Splunk Nix TA app and a Deployment Server to distribute the app.
The thing is I cannot deployed the same TA on the two groups since I want to configure different local/inputs.conf depending on the server's group.

How would you do that ? My idea was to deploy the Splunk TA Nix without modification (no edit of local/* files) and create two other different apps with only the configuration on inputs for the necessary group.

At the end I would end up with :
- Servers of group A : default Splunk TA Nix + Custom app for inputs A
- Servers of group B : default Splunk TA Nix + Custom app for inputs B

What do you think of this approach ?

Thanks,
GaetanVP

[gcusello]

Hi @GaetanVP,

it's the same I'd use.

if some input error in _internal don't disturb you and the folders to monitor aren't also present in the other server group, you could create only one custom app, containing both your custom input and deploy it to both the server groups.

Ciao.

Giuseppe

[GaetanVP]

Hello @gcusello thanks for your answer,

Okok I will deployed the base Nix app and a custom one for each group.

Thanks !
GaetanVP 

[isoutamo]

There was on Splunk Slack just a discussion about this problematic https://splunk-usergroups.slack.com/archives/C77SVATMZ/p1691397606241949.
I that this base TA + local TA is normal way to do it. Just check that you name those so that you have correct precedence if/when needed (use btool to check if needed).