All Apps and Add-ons

How to duplicate/clone a deployment app (Splunk Add-on for Microsoft Windows) with a different config?

jcrosby21
Path Finder

We are using the Splunk Add-on for Microsoft Windows to get Windows Event sourcetypes that we're forwarding from Universal Forwarders. We're managing our UF's with a deployment server. I would like to have different settings for inputs.conf with the Splunk_TA_windows add-on for different UF's, but would still like to maintain all types of configuration from the deployment server.

Am I correct in thinking I can duplicate the app on my deployment server to apply to other types of UF's as "Splunk_TA_windows2"? Is there a better way to leverage the same app from a deployment server with different configurations for server classes?

1 Solution

maciep
Champion

I'm not sure if it's the best approach, but that's the way we do it. We have 3 separate copies of that app we deploy to different types of devices in our env, each with different inputs settings.

View solution in original post

maciep
Champion

I'm not sure if it's the best approach, but that's the way we do it. We have 3 separate copies of that app we deploy to different types of devices in our env, each with different inputs settings.

jcrosby21
Path Finder

Glad I'm not the first one with the idea then. Has that worked out okay? When you upgrade do you just re-clone and move your local .conf's back for all 3 copies?

Little surprised there wasn't a standard answer somewhere. Seems like the need to have different configurations of an app for different service groups would be somewhat common.

0 Karma

maciep
Champion

It's worked out for our needs. We haven't upgraded the app yet, but I don't imagine much would change for the inputs between versions. And we don't really touch the apps often, only if we need to start or stop ingesting a new event id or event log, etc. And in some cases it affects all of the copies and some cases just one particular copy.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...