Dear experts,
My customer has 100 universal forwarders and each of the UFs are running the Splunk App for Stream. The problem is that each UF needs to have different settings for monitoring network interfaces. For example, in some UF, only eth8 and eth9 network interface should be monitored and the other network interfaces should be disabled. And another UF needs to monitor eth0 and eth1 only and the others should not be monitored.
He wants to handle the UFs with a deployment server. How should he define the serverclasses and deployment-apps configuration? Does he need to prepare many Stream TAs with different streamfwd.xml in deployment-app folder and have many serverclasses for each?
Any idea would be very appreciated.
Thank you.
↧