Still learning the proper procedure, but which apps can I install on forwarders?
I've installed a few on the Splunk server, but I'm assuming now I have to copy those to $SPLUNK_HOME/etc/deployment_apps/ location to push them out to all the forwarders?
If you are talking about apps from Splunk Base (apps.splunk.com), then usually only the Technology Add-Ons
(*-TA) apps. If you are talking about home-brew stuff, I usually create an app called mynewthing_inputs
and put inputs.conf
and props.conf
in it and send that payload, assuming you are not using a Heavy Forwarder.
If you are talking about apps from Splunk Base (apps.splunk.com), then usually only the Technology Add-Ons
(*-TA) apps. If you are talking about home-brew stuff, I usually create an app called mynewthing_inputs
and put inputs.conf
and props.conf
in it and send that payload, assuming you are not using a Heavy Forwarder.
Thank you!