I have a list of servers divided into different environments.
I will be installing a Splunk Universal Forwarder on each server and targeting a Splunk Enterprise instance.
I would like to create deployment apps on the enterprise instance, that will configure each environment.
Is it possible to use just one deployment app and thereby one inputs.conf for each environment, where it will monitor a path based on the hostname? e.g. something like:
`if($hostname == "a")
[monitor://C:\LogFiles\A]
elif ($hostname == "b")
[monitor://C:\LogFiles\B] `
Or will I need to create seperate inputs.conf for each individual server? And thereby also having to create a new deployment application for each server?
[possible duplicate][1]
[edit]: not enough karma for posting link.
[1]: https://answers.splunk.com/answers/521945/how-to-use-single-inputsconf-across-multiple-forwa.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev
↧