I am a splunk user and need help/ suggestion to use splunk in specific scenario.
I need to use splunk in multi-server servers environment, where server configurations are dynamic and scripted.
For each server there are multiple inputs for logs in inputs.conf (like app, system, backend server etc.)
Is there a way to drop multiple conf files like nginx in conf.d and then include them?
OR each server config script will edit the single input.conf and add its own input.
This is because i want to generate input.conf dynamically based on server configuration.
Any help/ suggestions will be helpful.
I think what you want is exactly what is handled by the standard Splunk configuration system, since multiple inputs.conf files are merged if they are in multiple folders. Please read the documenation on configuration files to see how to arrange the files, as well as rules on conflict resolution.