Can any one please let me know the best way to update the opt/splunkforwarder/etc/system/local/inputs.conf of universal forwarder from a deployment server. I'm able to achieve this by creating an app called local in deployment server but Is there any better way to do this ?
If you have configured your Deployment Server correctly and you have an app called myfirstapp.
Here is a sample serverclass.conf:
Defaults for app repository on Deployment server: $SPLUNK_HOME\etc\deployment-apps
Default for install location on client server: $SPLUNK_HOME\etc\apps
#serverclass.conf
#default deployment server settings
[global]
repositoryLocation=$SPLUNK/etc/deployment-apps #repository of your apps you wish to deploy
restartSplunkd=false
restartSplunkWeb=false
stateOnClient=disabled #all apps are disable unless stated at higher precede stanza
blacklist.0=* # all server are blacklisted unless stated at higher precede stanza
continueMatching=true
#my forwarders class. This class will deploy all apps under this calss to any server in 10.1.251.* range
[serverClass:forwarders]
restartSplunkd=true #restart Splunkd after install
stateOnClient=enabled
whitelist.0=10.1.251.* #Range of Forwarders
#deploy myfirstapp using serverClass fowarders
#location of my firstapp: $SPLUNK_HOME\etc\deployment-apps\firstapp
[serverClass:forwarders:app:myfirstapp]
On your forwarder if not configured:
#deploymentclient.conf
[deployment-client]
Disabled=false
phoneHomeIntervalInSecs = 300
[target-broker:deploymentServer]
targetUri=:8089
To list deployment clients use: splunk list deploy-clients
Additional reading:
http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/ConfigureDeploymentClients
http://docs.splunk.com/Documentation/Splunk/5.0/Admin/Serverclassconf
http://wiki.splunk.com/Deploy:DeploymentServer
Hope this helps.
Give me a moment and I'll have a sample config.
I'm looking for a way to deploy it as an app itself
Yes, but the issue is I do have a serverclass.conf file that is set to deploy in to opt/splunkforwarder/etc/system/local directory instead of apps.
Have you configured your Deployment server? Is your UF configured to contact said Deployment Server?