Getting Data In

Full blow instances of apps on Universal Forwarders?

byronschwab
Engager

I have been reading link:Splunk 4.2 Universal Forwarder *nix

Why does a universal forwarder need the entire *nix application, isn't the

3 - Copy /splunk/etc/apps/unix/default/app.conf to /splunk/etc/apps/unix/local/app.conf

4 - Edit the app.conf in the local directory to say: app=enabled

5 - Copy /splunk/etc/apps/unix/default/inputs.conf to /splunk/etc/apps/unix/local/

enough and then the rest of the app's directories can be deleted?

Tags (2)
0 Karma
1 Solution

mw
Splunk Employee
Splunk Employee

The determination of which parts of an app are necessary can be found here:

http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F

When you look at that, you'll see that the UF is working against the "input" phase only. However, there are a few items that could occur within that phase:

- inputs.conf
- props.conf
  - sourcetype
  - CHARSET
  - NO_BINARY_CHECK
  - CHECK_METHOD
- wmi.conf
- regmon-filters.conf

So, it really depends on the app itself. In many cases, you're correct that only the inputs.conf is necessary (you really don't even need the app.conf). My personal preference is to only put those items which are strictly necessary on the UF (i.e. what you're asking about). You just have to be sure that you know which things those are. In general, it's easier to just dump the entire app though, rather than consider what's needed.

View solution in original post

mw
Splunk Employee
Splunk Employee

The determination of which parts of an app are necessary can be found here:

http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F

When you look at that, you'll see that the UF is working against the "input" phase only. However, there are a few items that could occur within that phase:

- inputs.conf
- props.conf
  - sourcetype
  - CHARSET
  - NO_BINARY_CHECK
  - CHECK_METHOD
- wmi.conf
- regmon-filters.conf

So, it really depends on the app itself. In many cases, you're correct that only the inputs.conf is necessary (you really don't even need the app.conf). My personal preference is to only put those items which are strictly necessary on the UF (i.e. what you're asking about). You just have to be sure that you know which things those are. In general, it's easier to just dump the entire app though, rather than consider what's needed.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...