Deployment Architecture

Sending updates to conf file using deployment server

ajaysamantbms
Explorer

Is it possible to update only one stanza of a conf file (e.g inputs.conf) and not touch other parts of configuration.

What i understand is when i push the conf file through deployment server, entire file will get replaced with the new file from the server..

Tags (1)
0 Karma
1 Solution

aholzer
Motivator

You are correct, it will replace the entire file. For that matter it will in fact replace the entire app. If you have appA on your deployserver, and it only contains inputs.conf, and your forwarder has appA that contains inputs.conf and outputs.conf. Once your deployserver sends the update, your appA will not have the outputs.conf.

What you should do is make a copy of the app onto your deployserver, make the necessary changes on your deployserver, and from now on only ever make changes on the deploysever.

Hope this helps.

View solution in original post

aholzer
Motivator

You are correct, it will replace the entire file. For that matter it will in fact replace the entire app. If you have appA on your deployserver, and it only contains inputs.conf, and your forwarder has appA that contains inputs.conf and outputs.conf. Once your deployserver sends the update, your appA will not have the outputs.conf.

What you should do is make a copy of the app onto your deployserver, make the necessary changes on your deployserver, and from now on only ever make changes on the deploysever.

Hope this helps.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...