Multiple inputs files, with 1 app?

[skeer007]

Hey all, So I found a question here about using multiple inputs.conf files.. how it's possible with multiple apps but not just one. My question is, would this work if you copied the single app you have to a new directory?  Say you have App 1, you copy it to App 2. Since the contents are the same.. as long as you did not try to monitor the same log files.. would this work and be considered two apps?

[skeer007]

Thanks gcusello, So yeah obviously the right path and must have a different name. So it doesn't matter that its the 'same' app then right? 

And having multiple apps, with their own inputs.conf is totally supported?

[gcusello]

Hi @skeer007,

yes, you have two different Add-Ons.

Put attention only to one thing: don't use duplicated inputs because they will be used only one time.

In other words, in in the two Add-Ons you have to monitor the same file, it will be monitored only one time.

if one answer solves your need, please accept one answer for the other people of Community or tell me how I can help you.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[skeer007]

Good deal. awesome thanks for your help!  I was def aware of the 'don't monitor the same file in more than 1 inputs.conf file' but having two apps who have identical configuration files (except for inputs) made me worry about whether would work correctly or not.

[gcusello]

Hi @skeer007,

as I said, if the configuration on the same fiels are the same there's no conflict, there could be a problem if you have different configuration (e.g. a different index) because only one of them will be taken.

For this reason I hint to avoid duplicated configurations: in the second Add-On put only the changed inputs.

Ciao.

Giuseppe

[gcusello · Accepted solution]

Hi @skeer007,

if you copy an app in another folder (always in $SPLUNK_HOME/etc/apps), obviously you have to use a different name, in this way you are creating a new app.

You cannot put the new app in another location.

Ciao.

Giuseppe