Hi David. Thanks for helping me get started.
In my example, would I create three instances/copies of the MS SQL add-on, ie. Splunk_TA_microsoft-sqlserver_Grp1, Splunk_TA_microsoft-sqlserver_Grp2, and Splunk_TA_microsoft-sqlserver_Grp3, each with its own inputs.conf?
Or could I achieve the same goal by creating a fourth instance of the MS SQL add-on with the folder structure shown below (with \local but no inputs.conf) pushed out to all SQL hosts:
\Splunk_TA_microsoft-sqlserver
license-eula.txt
license-eula.rtf
app.manifest
README.txt
\lookups
\metadata
\default
\samples
\static
\local
eventtypes.conf
tags.conf
app.conf
sqlserver_dbx2.conf
db_input_templates.conf
eventgen.conf
transforms.conf
(NO inputs.conf)
props.conf
savedsearches.conf
\data
And each SQL host will then get a second app with just the inputs.conf customized with the proper perfmon stanzas:
\Splunk_TA_microsoft-sqlserver_Grp1
\local
inputs.conf
\Splunk_TA_microsoft-sqlserver_Grp2
\local
inputs.conf
\Splunk_TA_microsoft-sqlserver_Grp3
\local
inputs.conf
So each SQL host will get two apps - the complete SQL add-on app and a custom add-on with just inputs.conf. Is the second method do-able and am I making it more complicated than it needs to be?
... View more