I have tried to follow the documetation for creating directories and adding the apps, etc.. All I want to do is be able to make a change to inputs.config and outputs.config without having to visit the remote machines. The forwarders are installed and pointing to the main server. One of them even checked in and supposedly updated the APP, however it is not working and the files copied are in a strange location, not mirroring the server side.
I have placed folders with the files I want to update on the forwarders in the following server location. C:\Program Files\Splunk\etc\deployment-apps\MYConfig1 and C:\Program Files\Splunk\etc\deployment-apps\Myconfig2 In those folders are default and local folders, the local folder was created by default and has lock on it and not shared. I tried placing the files in both locations with no change in result.
On the client side, the following is what gets "updated"
In C:\Program Files\SplunkUniversalForwarder\etc*deployment-apps* folder there is nothing. In the C:\Program Files\SplunkUniversalForwarder\etc*apps* folder the Myconfig1 folder does show up with its files. They just don't get used.
In fact, the normal C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf file also appears to have no effect either. I have blanked it out and I still get the inputs that were specified at install in the gui being sent to my indexer.
What is the expected behavior for where to place on the server, where it copies to on the forwarder, and where to check when it does not work?
... View more