Getting Data In

Using same inputs.conf for multiple forwarders with different monitor paths

Jetj
Engager

I have a list of servers divided into different environments.
I will be installing a Splunk Universal Forwarder on each server and targeting a Splunk Enterprise instance.
I would like to create deployment apps on the enterprise instance, that will configure each environment.

Is it possible to use just one deployment app and thereby one inputs.conf for each environment, where it will monitor a path based on the hostname? e.g. something like:
if($hostname == "a")
[monitor://C:\LogFiles\A]
elif ($hostname == "b")
[monitor://C:\LogFiles\B]

Or will I need to create seperate inputs.conf for each individual server? And thereby also having to create a new deployment application for each server?

possible duplicate
[edit]: not enough karma for posting link.

inventsekar
SplunkTrust
SplunkTrust

it looks like a good option, but currently inputs.conf can not have if conditions.

maybe, simply add all files to the inputs.conf, the files will be present only on particular hosts, on that host, that file will get monitored and other file will not be available/not monitored.

[monitor://C:\LogFiles\A] 
----
----
----
[monitor://C:\LogFiles\B] 
----
---
---
thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

kamal_jagga
Contributor

I am also facing similar issue. This usually works fine. But i have a dev server with thousands of files in the directory being monitored.

After I added this server, the performance of other servers has also deteriorated as Splunk keeps crawling through all the files and folders to find the match.

As a workaround, I have created separate app for the dev server.

Still looking for ideal solution where i can mention - if server=A monitor=path A and server=B monitor=path B

0 Karma

Jetj
Engager

Thank you for your answer.

I had thought of this solution and actually tested it. And it works fine, by monitoring a directory (or file) that doesn't exist and therby not forwarding anything from that particular server.

My issue with this solution however is if two servers would have different logs in the same path. Say server A has logs in C:\Logs\ for application 1 and server B has logs in C:\Logs\ for application 2. This would cause some confusion as to where logs where coming from, wouldn't it? Or would I just have to specify my search further, to something like:
source = "C:\Logs\*" host = "[hostname]"

0 Karma

inventsekar
SplunkTrust
SplunkTrust

i am not sure, but, maybe, check the Splunk Scripted inputs option.
http://docs.splunk.com/Documentation/Splunk/6.6.3/AdvancedDev/ScriptSetup

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...