That worked great, but was creating a management challenge as the number of machines grew each with their own custom sourcetypes.
To address this. I am attempting to use the configuration deployment capabilities of Splunk.
So, I created an app called 'forwarder' on the deployment server and added my custom props.conf above.
And I created the appropriate stanzas in serverclass.conf to target the machine in question.
And I verified that the 'forwarder' app is getting deployed to the target machine.
The problem, however, is that my props.conf settings are now not being respected.
Do I need to be putting the config files in a different 'app'? Such as the 'search' app opr the SplunkUniversalForwarder app? Or are there rules that dictate in which order the configuration files of each of the managed 'apps' are processed?
[root@cove-cdn apps]$ pwd
[root@cove-cdn apps]$ ls -l
drwx------ 4 root root 4096 Oct 19 09:19 forwarder
drwxr-xr-x 5 root root 4096 Oct 17 10:40 learned
drwxr-xr-x 6 root root 4096 Oct 17 10:40 search
drwxr-xr-x 4 root root 4096 Apr 15 2011 SplunkUniversalForwarder
That's not the question. THe problem is that the sourcetype is not getting set now that the props.conf is being menaged in the deployment by the deployment server instead of being configured manually on the forwarder box.