Getting Data In

Deployment Server and Universal Forwarder- Which file is being monitored?

phularah
Communicator

I saw a question on the internet while searching for answers for a separate question and a few comments below regarding the correct answer for that. Now, I am confused as to what  should have been the correct answer. This was the question.


This file has been manually created on a universal forwarder:

/opt/splunkforwarder/etc/apps/my_TA/local/inputs.conf
[monitor:///var/log/messages]
sourcetype=syslog
index=syslog

A new Splunk admin comes in and connects the universal forwarders to a deployment server and deploys the same app with a new inputs.conf file:

/opt/splunk/etc/deployment-apps/my_TA/local/inputs.conf
[monitor:///var/log/maillog]
sourcetype=maillog
index=syslog

Which file is now monitored?
/var/log/maillog or both /var/log/maillog and /var/log/messages

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @phularah,

when you connect a client to a Deployment Server, all the local apps will be removed and the apps for the ServerClass containing that client will be deployed.

So if the local inputs.conf is in an app (as it seems from your information), it will be removed.

If you want to monitor both the folders, you have to insert the local stanza in the deployed app.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @phularah,

when you connect a client to a Deployment Server, all the local apps will be removed and the apps for the ServerClass containing that client will be deployed.

So if the local inputs.conf is in an app (as it seems from your information), it will be removed.

If you want to monitor both the folders, you have to insert the local stanza in the deployed app.

Ciao.

Giuseppe

isoutamo
SplunkTrust
SplunkTrust

Hi

it's just like @gcusello said. When the app name is same (installed into same path) then DS win. You could also check it with btool on UF side. Just 

splunk btool inputs list monitor:///var/log --debug

and then look the output which shows all monitored files under /var/log

r. Ismo

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...