Getting Data In

Setting custom sourcetypes on 'managed' universal forwarder

jcbrendsel
Path Finder

I struggling getting my props.conf to work now that i have moved to a universal forwarder.

On previous versions of the forwarder, I have had set sourcetypes based as follows in props.conf:

[source::.../home/coveapi/cdn/cloudfront/E1YQY7Y6N916UA...]
TZ = GMT
sourcetype = cloudfront_rtmp

That worked great, but was creating a management challenge as the number of machines grew each with their own custom sourcetypes.

To address this. I am attempting to use the configuration deployment capabilities of Splunk.

So, I created an app called 'forwarder' on the deployment server and added my custom props.conf above.

/opt/splunk/etc/deployment-apps/forwarder

And I created the appropriate stanzas in serverclass.conf to target the machine in question.

And I verified that the 'forwarder' app is getting deployed to the target machine.

The problem, however, is that my props.conf settings are now not being respected.

Do I need to be putting the config files in a different 'app'? Such as the 'search' app opr the SplunkUniversalForwarder app? Or are there rules that dictate in which order the configuration files of each of the managed 'apps' are processed?

[root@cove-cdn apps]$ pwd
/opt/splunkforwarder/etc/apps

[root@cove-cdn apps]$ ls -l
total 16
drwx------ 4 root root 4096 Oct 19 09:19 forwarder
drwxr-xr-x 5 root root 4096 Oct 17 10:40 learned
drwxr-xr-x 6 root root 4096 Oct 17 10:40 search
drwxr-xr-x 4 root root 4096 Apr 15  2011 SplunkUniversalForwarder

Any guidance would be greatly appreciated.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee
0 Karma

jcbrendsel
Path Finder

That's not the question. THe problem is that the sourcetype is not getting set now that the props.conf is being menaged in the deployment by the deployment server instead of being configured manually on the forwarder box.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...