Getting Data In

help needed with UF settings distributed over deployment server

damucka
Builder

Hello,

I would like to distribute one UF parameter to my clients, it is:

limits.conf
   ...
    [inputproc]
    file_tracking_db_threshold_mb = 150
    ...

For that I created an app called SplunkUniversalForwarder in the deployment-apps of the deployment server. I chose the app-name deliberately the same as on the forwarders, because I hoped that the changes there will be updated to the same folder on the UF.
Inside of the /etc/deployment-apps/SplunkUniversalForwarder/local, I created limits.conf with the single parameter above.
My expectation was that this app will be distributed to the clients and the "local" directory will be created inside of the existing /opt/splunkforwarder/etc/apps/SplunkUniversalForwarder directory there.
This was the case, however the "default" directory there was wiped out. This means the app was distributed in the way that the existing one was overwritten.

Now, before I continue, I would like to ask what is the best practice to distribute the UF parametrisation like above via the deployment server. Per my understanding, if I use another app name, then it will be created on the UF, but will the limits.conf settings then be applied to the UF?
And what about upgrading the UF software to the higher version? Will it wipe out the changes I made in "local" above?
I mean I could copy-paste what is in the default/limits.conf to local/limits.conf on the deployment server and redistribute it, but my concern is if it stays there after the UF software upgrade ...

Please advise.

Kamil

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

When an app is deployed to a forwarder, the entire contents of the app are replaced on the forwarder. This includes the local directory, unless it is excluded (see https://docs.splunk.com/Documentation/Splunk/8.0.1/Updating/Excludecontent). Since there should not be any local configuration changes on a forwarder, this is OK.

You can use a different app to deploy the setting, but keep in mind apps are applied in alphabetical order with the first app winning.

Do NOT copy-paste all of a default config file to local. Copy only the attributes (and their stanza names) you need to override.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

When an app is deployed to a forwarder, the entire contents of the app are replaced on the forwarder. This includes the local directory, unless it is excluded (see https://docs.splunk.com/Documentation/Splunk/8.0.1/Updating/Excludecontent). Since there should not be any local configuration changes on a forwarder, this is OK.

You can use a different app to deploy the setting, but keep in mind apps are applied in alphabetical order with the first app winning.

Do NOT copy-paste all of a default config file to local. Copy only the attributes (and their stanza names) you need to override.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...