When we first rolled out Splunk, the deployment server was not used. Its been a while now & I want to move to a deployment server architecture. My question is:
Should I remove everything from etc/system/local that was put on the individual instances of Splunk or can I leave that and will the deployment apps override those?
Thanks.
Kevin
deployment apps will not over write the settings in etc/system/local. You may find that you have some settings configured in etc/system/local that make more sense managing with a deployed application. If that is the case, you would have to comment out the setting in etc/system/local so that the application would control the setting. I would start out deploying apps one at a time to migrate system/local settings that make sense. Then most of the apps you deploy can contain new inputs or other functionallity.
deployment apps will not over write the settings in etc/system/local. You may find that you have some settings configured in etc/system/local that make more sense managing with a deployed application. If that is the case, you would have to comment out the setting in etc/system/local so that the application would control the setting. I would start out deploying apps one at a time to migrate system/local settings that make sense. Then most of the apps you deploy can contain new inputs or other functionallity.
That's what I was figuring but I wanted to make sure. I have basically migrated all settings for inputs/outputs/transforms/etc from conf files in /etc/system/local to their own apps to be managed, so its a matter of removing these from the conf files & syncing with the deployment server.
Thanks for your help.