Hi,
I am looking to deploy the Splunk_TA_nix to multiple servers. I would like to have different inputs.conf depending on the server type, all deployed from the same deployment server.
There are a few options I have considered:
1. Renaming the Splunk_TA_nix app depending on the server type (e.g. Splunk_TA_nix_dns, Splunk_TA_nix_sql). The problem with this is that there are a few references within the app to the app name itself, and I do not want this to cause issues.
2. Creating a new app per server type with just the inputs.conf. The issue with this is that the script inputs use the relative path (e.g. ./cpu.sh); if I use this same stanza name in my app, it will not work. If the absolute path is used, it works fine, but this is bad practice as the forwarder paths may differ depending on installation type (e.g. /opt/splunk or /opt/splunkforwarder).
Has anyone had any experience with this who might be able to lend some advice please?
Thank you, Carl
↧