My Splunk Forwarder is installed on a share, which can be mapped to all the servers in my environment. Therefore, I am wondering if it is possible to use binaries out this common location, but have configs installed elsewhere, locally on each server. If so, I would not need to worry about deploying Splunk Forwarders to all the servers, I will be simply pushing configs as needed.
Is it possible to define a custom location for Universal Forwarder local configs (.../etc/system/local)? For example, set this as an ENV variable prior to starting the forwarder, or maybe passing-in this location as an argument, such as:
.../splunkforwarder/bin/splunk start -local-conf /my/custom/config/location/etc/system/local
And similarly for the logs location?
I realize I can probably use symlinks to achieve this. But I was wondering if Splunk supports the ability to define custom config/log paths.
↧