Getting Data In

Remotely Managing Data Inputs

lelanb
Engager

Is there a way to remotely manage data inputs, via configuration files pushed out by a deployment server?

I have perhaps 25-50 machines I will probably run Splunk on, and I need to know if it is possible to change the configuration settings for whole groups of servers at a time.

If so- could you point me in the right direction as to the process involved?

1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Yes. You would use the Deployment Server to push out new inputs.conf files to the clients, and restart splunkd. All inputs are defined in these files. Updating through the GUI or CLI updates these files in the same way, so appropriate files can be generated by direct editing, or by configuring a prototype and copying the resulting files.

Deployment Server is described here: http://www.splunk.com/base/Documentation/latest/Admin/Aboutdeploymentserver

The definition of the configuration files is the same configuring any other Splunk forwarder, regardless of whether deployment server is being used.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

Yes. You would use the Deployment Server to push out new inputs.conf files to the clients, and restart splunkd. All inputs are defined in these files. Updating through the GUI or CLI updates these files in the same way, so appropriate files can be generated by direct editing, or by configuring a prototype and copying the resulting files.

Deployment Server is described here: http://www.splunk.com/base/Documentation/latest/Admin/Aboutdeploymentserver

The definition of the configuration files is the same configuring any other Splunk forwarder, regardless of whether deployment server is being used.

splunkIT
Splunk Employee
Splunk Employee
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...