Splunk Search

Single inputs.conf across multiple fowarder - How to

pl123
Path Finder

Hi there,

My Splunk environment is made up from 1 Deployment Server, 1 Indexer and 20+ light forwarders.

How could I go about setting up a single inputs.conf which is pushed from the deployment server to the forwarders. Each of the forwarders has a unique set of logs in various locations. I do not want to manage a single log file for each forwarder, but would rather have a single conf file which lists all the locations for various machines, with each machine only looking at the portion in the conf list which is relevant to itself (ie locations blocked via hostname)

Ideally I would have a file like this

inputs.conf

srv1
monitor://blah
...
monitor://basddsfd
...
monitor://dfsdf
...


srv2 
monitor://gdfg
....

etc

is this possible?

Cheers

Tags (1)
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

Yes. Just include all the monitored paths in the single indexes.conf. There's no harm in monitoring a path that doesn't exist.

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

Yes. Just include all the monitored paths in the single indexes.conf. There's no harm in monitoring a path that doesn't exist.

Stephen_Sorkin
Splunk Employee
Splunk Employee

Not really. We'll stat the path every few seconds, which should be negligible for tens of thousands of paths.

0 Karma

pl123
Path Finder

Would this not cause significant overhead on the machines that dont have the paths available to them?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...