help needed with UF settings distributed over deployment server

[damucka]

Hello,

I would like to distribute one UF parameter to my clients, it is:

limits.conf
   ...
    [inputproc]
    file_tracking_db_threshold_mb = 150
    ...

For that I created an app called SplunkUniversalForwarder in the deployment-apps of the deployment server. I chose the app-name deliberately the same as on the forwarders, because I hoped that the changes there will be updated to the same folder on the UF.
Inside of the /etc/deployment-apps/SplunkUniversalForwarder/local, I created limits.conf with the single parameter above.
My expectation was that this app will be distributed to the clients and the "local" directory will be created inside of the existing /opt/splunkforwarder/etc/apps/SplunkUniversalForwarder directory there.
This was the case, however the "default" directory there was wiped out. This means the app was distributed in the way that the existing one was overwritten.

Now, before I continue, I would like to ask what is the best practice to distribute the UF parametrisation like above via the deployment server. Per my understanding, if I use another app name, then it will be created on the UF, but will the limits.conf settings then be applied to the UF?
And what about upgrading the UF software to the higher version? Will it wipe out the changes I made in "local" above?
I mean I could copy-paste what is in the default/limits.conf to local/limits.conf on the deployment server and redistribute it, but my concern is if it stays there after the UF software upgrade ...

Please advise.

Kamil

[richgalloway · Accepted solution]

When an app is deployed to a forwarder, the entire contents of the app are replaced on the forwarder. This includes the local directory, unless it is excluded (see https://docs.splunk.com/Documentation/Splunk/8.0.1/Updating/Excludecontent). Since there should not be any local configuration changes on a forwarder, this is OK.

You can use a different app to deploy the setting, but keep in mind apps are applied in alphabetical order with the first app winning.

Do NOT copy-paste all of a default config file to local. Copy only the attributes (and their stanza names) you need to override.