Deployment Architecture

Sending updates to conf file using deployment server

ajaysamantbms
Explorer

Is it possible to update only one stanza of a conf file (e.g inputs.conf) and not touch other parts of configuration.

What i understand is when i push the conf file through deployment server, entire file will get replaced with the new file from the server..

Tags (1)
0 Karma
1 Solution

aholzer
Motivator

You are correct, it will replace the entire file. For that matter it will in fact replace the entire app. If you have appA on your deployserver, and it only contains inputs.conf, and your forwarder has appA that contains inputs.conf and outputs.conf. Once your deployserver sends the update, your appA will not have the outputs.conf.

What you should do is make a copy of the app onto your deployserver, make the necessary changes on your deployserver, and from now on only ever make changes on the deploysever.

Hope this helps.

View solution in original post

aholzer
Motivator

You are correct, it will replace the entire file. For that matter it will in fact replace the entire app. If you have appA on your deployserver, and it only contains inputs.conf, and your forwarder has appA that contains inputs.conf and outputs.conf. Once your deployserver sends the update, your appA will not have the outputs.conf.

What you should do is make a copy of the app onto your deployserver, make the necessary changes on your deployserver, and from now on only ever make changes on the deploysever.

Hope this helps.

Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...