- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: system local folder vs forwarder local folder
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In Heavyforwader if we go to SYSTEM directory we have Local and Default directories created by it self in which we have all the configuration files by default like( inputs.conf , output.conf , props.conf , transforms.conf , etc.,)
Now my question is why to enable SplunkForwarder for local directory and manually create all the configuration files (input.conf , output.conf, props.conf and transforms.conf ) ? and transfer the log data same as universal forwarder
why cant we forward the log data directly from system-->local directory to enterprise server...
plz correct me if there is any wrong.....
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The directory structure for indexers, heavy forwarders and universal forwarders is the same. You can put configuration files in SPLUNK_HOME/etc/system/local or you can put them in an app SPLUNK_HOME/etc/apps/AppName/local.
You should only create or edit files in the local subdirectories. Never change the files in the default subdirectories.
For indexers, heavy forwarders and universal forwarders, the BEST PRACTICE is the same: put your configurations in an app directory SPLUNK_HOME/etc/apps/AppName/local not the system-level directories. This makes your configurations easier to manage. Many people use the "search" app directory for general configurations. Config files such as inputs.conf, outputs.conf, deploymentclient.conf, props.conf and transforms.conf should be placed in an app-level directory.
The only configurations that SHOULD go into the SPLUNK_HOME/etc/system/localdirectory are true system settings such as the host name setting (in server.conf) and port numbers (in web.conf and server.conf).
If you follow the best practice, then it is easy to copy the entire app from one system to another, and the systems will be configured the same.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The directory structure for indexers, heavy forwarders and universal forwarders is the same. You can put configuration files in SPLUNK_HOME/etc/system/local or you can put them in an app SPLUNK_HOME/etc/apps/AppName/local.
You should only create or edit files in the local subdirectories. Never change the files in the default subdirectories.
For indexers, heavy forwarders and universal forwarders, the BEST PRACTICE is the same: put your configurations in an app directory SPLUNK_HOME/etc/apps/AppName/local not the system-level directories. This makes your configurations easier to manage. Many people use the "search" app directory for general configurations. Config files such as inputs.conf, outputs.conf, deploymentclient.conf, props.conf and transforms.conf should be placed in an app-level directory.
The only configurations that SHOULD go into the SPLUNK_HOME/etc/system/localdirectory are true system settings such as the host name setting (in server.conf) and port numbers (in web.conf and server.conf).
If you follow the best practice, then it is easy to copy the entire app from one system to another, and the systems will be configured the same.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This should add some clarity: http://docs.splunk.com/Documentation/Splunk/6.2.3/admin/Wheretofindtheconfigurationfiles
Splunk is Nurturing Tomorrow’s Cybersecurity Leaders Today
Part 2: A Guide to Maximizing Splunk IT Service Intelligence
Part 1: A Guide to Maximizing Splunk IT Service Intelligence
