Getting Data In

where to add my props.conf for new sourcetype - created using preview

Skins
Path Finder

I want to push out a props .conf file to monitor a file which resides on two machines with forwarders deployed.

my env consists of 1 x sh , 2 x indexer (not clustered) 2 x ufs

So far i have used the manual file upload method to create a new sourcetype and used the preview window to separate and timestamp my events how i want.

Now i'm unclear best practice to deploy these to the indexers and where they should reside ? should they also be added to my deployment apps directory and deployed to the forwarders ?

gratzi

Tags (1)
0 Karma

adonio
Ultra Champion

Hello @Skins,
There are couple questions here, I will try to address one by one
You will probably want to push inputs.conf to monitor a file and not props.conf,
this is a great wiki page that explains where conf files go:
https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F
to automate this process across forwarder (and other splunk instances) you can use one of your splunk instances as a Deployment Server. According to your architecture description, your Search Head is the best candidate.
here is docs on how to configure deployment server and deployment clients (pay attention that Indexers can be clients too!):
http://docs.splunk.com/Documentation/Splunk/6.6.0/Updating/Configuredeploymentclients
now you can build small apps that will carry configurations such as inputs, outputs, props and more!
create serverclasses and assign clients and apps to groups, now you can control your Indexers configuration and forwarders configurations from one single machine.

Let us know if it worked well.

hope it helps

Skins
Path Finder

That was an error in my original post - i meant the inputs.conf for the file monitoring.

I didnt however think of using the DS to deploy to the indexers as well as the UF's

gratzi

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...