I struggling getting my props.conf to work now that i have moved to a universal forwarder.
On previous versions of the forwarder, I have had set sourcetypes based as follows in props.conf:
[source::.../home/coveapi/cdn/cloudfront/E1YQY7Y6N916UA...] TZ = GMT sourcetype = cloudfront_rtmp
That worked great, but was creating a management challenge as the number of machines grew each with their own custom sourcetypes.
To address this. I am attempting to use the configuration deployment capabilities of Splunk.
So, I created an app called 'forwarder' on the deployment server and added my custom props.conf above.
And I created the appropriate stanzas in serverclass.conf to target the machine in question.
And I verified that the 'forwarder' app is getting deployed to the target machine.
The problem, however, is that my props.conf settings are now not being respected.
Do I need to be putting the config files in a different 'app'? Such as the 'search' app opr the SplunkUniversalForwarder app? Or are there rules that dictate in which order the configuration files of each of the managed 'apps' are processed?
[root@cove-cdn apps]$ pwd /opt/splunkforwarder/etc/apps [root@cove-cdn apps]$ ls -l total 16 drwx------ 4 root root 4096 Oct 19 09:19 forwarder drwxr-xr-x 5 root root 4096 Oct 17 10:40 learned drwxr-xr-x 6 root root 4096 Oct 17 10:40 search drwxr-xr-x 4 root root 4096 Apr 15 2011 SplunkUniversalForwarder
Any guidance would be greatly appreciated.
That's not the question. THe problem is that the sourcetype is not getting set now that the props.conf is being menaged in the deployment by the deployment server instead of being configured manually on the forwarder box.