Getting Data In

where to add my props.conf for new sourcetype - created using preview

Skins
Path Finder

I want to push out a props .conf file to monitor a file which resides on two machines with forwarders deployed.

my env consists of 1 x sh , 2 x indexer (not clustered) 2 x ufs

So far i have used the manual file upload method to create a new sourcetype and used the preview window to separate and timestamp my events how i want.

Now i'm unclear best practice to deploy these to the indexers and where they should reside ? should they also be added to my deployment apps directory and deployed to the forwarders ?

gratzi

Tags (1)
0 Karma

adonio
Ultra Champion

Hello @Skins,
There are couple questions here, I will try to address one by one
You will probably want to push inputs.conf to monitor a file and not props.conf,
this is a great wiki page that explains where conf files go:
https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F
to automate this process across forwarder (and other splunk instances) you can use one of your splunk instances as a Deployment Server. According to your architecture description, your Search Head is the best candidate.
here is docs on how to configure deployment server and deployment clients (pay attention that Indexers can be clients too!):
http://docs.splunk.com/Documentation/Splunk/6.6.0/Updating/Configuredeploymentclients
now you can build small apps that will carry configurations such as inputs, outputs, props and more!
create serverclasses and assign clients and apps to groups, now you can control your Indexers configuration and forwarders configurations from one single machine.

Let us know if it worked well.

hope it helps

Skins
Path Finder

That was an error in my original post - i meant the inputs.conf for the file monitoring.

I didnt however think of using the DS to deploy to the indexers as well as the UF's

gratzi

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...