Splunk Add-on for *Nix "ignoring alternate expansion" for specified inputs on new server

[manderson7]

I've got the Splunk_TA_nix app installed on all of my *nix servers, and only want to get top, ps and vmstat from certain servers. I copied the Splunk_TA_nix app to a new app, copied over the inputs that I wanted and deployed to that server. I'm not getting those sourcetypes from a search on that server, and a skim of splunkd on that server shows:

08-08-2017 15:30:52.479 -0400 WARN  IConfCache - Stanza has an expansion [script:///opt/splunk/etc/apps/Splunk_TA_nix/bin/ps.sh], ignoring alternate expansion [script:///opt/splunk/etc/apps/Splunk_TA_nix_DHIS/bin/ps.sh] in inputs.conf
08-08-2017 15:30:52.479 -0400 WARN  IConfCache - Stanza has an expansion [script:///opt/splunk/etc/apps/Splunk_TA_nix/bin/top.sh], ignoring alternate expansion [script:///opt/splunk/etc/apps/Splunk_TA_nix_DHIS/bin/top.sh] in inputs.conf
08-08-2017 15:30:52.479 -0400 WARN  IConfCache - Stanza has an expansion [script:///opt/splunk/etc/apps/Splunk_TA_nix/bin/vmstat.sh], ignoring alternate expansion [script:///opt/splunk/etc/apps/Splunk_TA_nix_DHIS/bin/vmstat.sh] in inputs.conf

What am I doing wrong here? Thanks.

[sloshburch]

The problem is the scripted inputs are defined with relative paths. So pull path changes when the app name changes. See a complete explanation and walkthrough of workarounds in the post What are best practices for deploying an add-on with slightly different configurations?

[napomokoetle]

In my situation I had the same scripts deployed to .../apps/Splunk_TA_nix_spectrum/bin as were already existing in .../apps/Splunk_TA_nix/bin on the HF agents.
That generated the errors as per your post. I then deleted the scripts in the path .../apps/Splunk_TA_nix/bin and my redeployed and the monitor scripts in my app folder .../apps/Splunk_TA_nix_spectrum/bin started working as expected.

[manderson7]

I told inputs.conf to use the scripts in Splunk_TA_nix instead of Splunk_TA_nix_DHIS, and it stated working. Unsure why, but not arguing.

[hardikJsheth]

You should not copy same contents to multiple apps. Ideally you can just disable unnecessary inputs by making changes to $SPLUNK_HOME/etc/apps/Splunk_TA_nix/local/inputs.conf instead.