My Splunk environment is made up from 1 Deployment Server, 1 Indexer and 20+ light forwarders.
How could I go about setting up a single inputs.conf which is pushed from the deployment server to the forwarders. Each of the forwarders has a unique set of logs in various locations. I do not want to manage a single log file for each forwarder, but would rather have a single conf file which lists all the locations for various machines, with each machine only looking at the portion in the conf list which is relevant to itself (ie locations blocked via hostname)
Ideally I would have a file like this
inputs.conf srv1 monitor://blah ... monitor://basddsfd ... monitor://dfsdf ... srv2 monitor://gdfg .... etc
is this possible?
Yes. Just include all the monitored paths in the single indexes.conf. There's no harm in monitoring a path that doesn't exist.
Not really. We'll stat the path every few seconds, which should be negligible for tens of thousands of paths.