All Apps and Add-ons

Splunk_TA_nix multiple inputs configurations

carlalldis
Explorer

Hi,

I am looking to deploy the Splunk_TA_nix to multiple servers. I would like to have different inputs.conf depending on the server type, all deployed from the same deployment server.

There are a few options I have considered:

  1. Renaming the Splunk_TA_nix app depending on the server type (e.g. Splunk_TA_nix_dns, Splunk_TA_nix_sql). The problem with this is that there are a few references within the app to the app name itself, and I do not want this to cause issues.
  2. Creating a new app per server type with just the inputs.conf. The issue with this is that the script inputs use the relative path (e.g. ./cpu.sh); if I use this same stanza name in my app, it will not work. If the absolute path is used, it works fine, but this is bad practice as the forwarder paths may differ depending on installation type (e.g. /opt/splunk or /opt/splunkforwarder).

Has anyone had any experience with this who might be able to lend some advice please?

Thank you, Carl

0 Karma
1 Solution

tsweet_splunk
Splunk Employee
Splunk Employee

I usually use way #2 but use $SPLUNK_HOME so that you do not need to worry about the deployment type (Enterprise or Forwarder). This would require pushing both the original Splunk_TA_nix (containing the scripts) and custom Splunk_TA_nix_mycustomtype_inputs applications to the NIX UF's.

[script://$SPLUNK_HOME/etc/apps/Splunk_TA_nix/bin/netstat.sh]

View solution in original post

carlalldis
Explorer

Thanks tsweet; I never considered using that. Very helpful.

0 Karma

tsweet_splunk
Splunk Employee
Splunk Employee

I usually use way #2 but use $SPLUNK_HOME so that you do not need to worry about the deployment type (Enterprise or Forwarder). This would require pushing both the original Splunk_TA_nix (containing the scripts) and custom Splunk_TA_nix_mycustomtype_inputs applications to the NIX UF's.

[script://$SPLUNK_HOME/etc/apps/Splunk_TA_nix/bin/netstat.sh]

Dharani
Explorer

Hi @tsweet_splunk 

In this case , 

Do we need to install this add-on on the Linux hosts also? or pushing this configuration from DS to host is enough?

 

Thanks,

Dharani

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...