Best way to change the inputs.conf file of a universal forwarder from deployment server.

[ssankeneni]

Can any one please let me know the best way to update the opt/splunkforwarder/etc/system/local/inputs.conf of universal forwarder from a deployment server. I'm able to achieve this by creating an app called local in deployment server but Is there any better way to do this ?

[bmacias84]

If you have configured your Deployment Server correctly and you have an app called myfirstapp.
Here is a sample serverclass.conf:

Defaults for app repository on Deployment server: $SPLUNK_HOME\etc\deployment-apps

Default for install location on client server: $SPLUNK_HOME\etc\apps

#serverclass.conf

#default deployment server settings

[global]

repositoryLocation=$SPLUNK/etc/deployment-apps #repository of your apps you wish to deploy

restartSplunkd=false

restartSplunkWeb=false

stateOnClient=disabled #all apps are disable unless stated at higher precede stanza

blacklist.0=*  # all server are blacklisted unless stated at higher precede stanza

continueMatching=true 

#my forwarders class.  This class will deploy all apps under this calss to any server in 10.1.251.* range

[serverClass:forwarders]

restartSplunkd=true #restart Splunkd after install

stateOnClient=enabled

whitelist.0=10.1.251.* #Range of Forwarders

#deploy myfirstapp using serverClass fowarders

#location of my firstapp: $SPLUNK_HOME\etc\deployment-apps\firstapp

[serverClass:forwarders:app:myfirstapp]

On your forwarder if not configured:

#deploymentclient.conf

[deployment-client]

Disabled=false

phoneHomeIntervalInSecs = 300

[target-broker:deploymentServer]

targetUri=:8089

To list deployment clients use: splunk list deploy-clients

Additional reading:

http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/ConfigureDeploymentClients

http://docs.splunk.com/Documentation/Splunk/5.0/Admin/Serverclassconf

http://wiki.splunk.com/Deploy:DeploymentServer

Hope this helps.

[bmacias84]

Give me a moment and I'll have a sample config.

[ssankeneni]

I'm looking for a way to deploy it as an app itself

[ssankeneni]

Yes, but the issue is I do have a serverclass.conf file that is set to deploy in to opt/splunkforwarder/etc/system/local directory instead of apps.

[bmacias84]

Have you configured your Deployment server? Is your UF configured to contact said Deployment Server?