I've got my custom apps (mostly custom inputs.conf files) working, and now I'm looking into configure some of the default apps, at this point SplunkLightForwarder (enable it) and sample_app (disable it).
I've got the forwarding functioning with my own "fwd-to-splunk01" app (outputs.conf file), but this doesn't kill the webserver on the server, neither does it run in forward only mode, all which the SplunkLightForwarder does.
I did try this simple config, hoping it would work, but it didn't:
[serverClass:LightForwarder:app:SplunkLightForwarder]
stateOnClient = enable
restartSplunkd = true
I know the reason. Reading the splunkd.log I see this:
08-16-2010 16:57:46.452 WARN Application - Application: SplunkLightForwarder cannot be loaded as path: /opt/splunk/etc/deployment-apps/SplunkLightForwarder does not exist.
08-16-2010 16:57:46.452 WARN ServerClass - Unable to load application: SplunkLightForwarder
Creating a /opt/splunk/etc/deployment-apps/SplunkLightForwarder/local/app.conf which could enable the app replaces the entire /opt/splunk/etc/apps/SplunkLightForwarder on my client. I've read other places here on Splunk Answers that I should link or copy the whole app from /opt/splunk/etc/apps/SplunkLightForwarder to /opt/splunk/etc/deployment-apps/SplunkLightForwarder on my server, but I was hoping there were other means to get this configured (and the only config I want at this point is to activate LightForward and disable sample_app).
Why I'm asking, is that if I link from apps to deployment-apps on my server and then upgrade my splunk indexer/deployment server (they are on the same server), my clients that happen to not be upgraded at that time could potentially get a config that is not working with the version installed on the client. Or the other way around.. (newer client doesn't like old defaults for LightForwarder). Is this a valid problem?
Comments?
... View more