Deployment Server Configs

[Nawab]

we have a running splunk deployment, where UFs are reading inputs from system/local and now we want to switch from system local to app/local. since both inputs and outputs have same stanzas, is it possible to remove system/local/inputs.conf using deployment server. OR we have to manually remove all.

[gcusello]

Hi @Nawab ,

the only way to remove conf files from system/local is a script.

You can put this script in an add-on deployed to the clients with the Deployment Server but why?

This activity must be executed only one time, so I'd prefer to run the script by itself.

Oviously remember to execute this deletion, after that you pushed the add-ons with the new configurations using the Deployment Server, and remember to restart the clients.

Ciao.

Giuseppe

[PrewinThomas]

@Nawab 

As others mentioned manual deletion is safer.

You can remove files from system/local using the Deployment Server, but it usually involves setting up a scripted input (like a script that deletes the files). This method is best if you’re comfortable with scripted inputs and have a bigger environment to manage.

Once removed, your app-based inputs.conf will take effect as expected.

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[PickleRick]

Well, you've just learned the hard way why putting settings into system/local is not recommended. Settings put there have the highest priority (except for the settings pushed from the CM in case of clustered indexes) and they cannot be modified by settings pulled from the DS.

So only those setting which are supposed to be "immutable" should be put there.

Unfortunately, in your case the only supported way is to manually remove the settings from there. There are some dirty hacks which @livehybrid mentioned but they are risky and require knowledge of both Splunk and scripting (and can still fail even if executed "properly" if - for example - files in system/local aren't owned by Splunk user but are only readable by splunkd).

[livehybrid]

Hi @Nawab 

If you have remote config on those boxes in system/local, the only *safe* way to do this is to manually remove, its not possible natively to modify the system/local configuration from the Deployment Server. There are other ways to achieve this using scripts within a custom app to do so, but introduces risk so only look into this if you're comfortable with writing custom scripts within apps and the impact this would have.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing