Hello, i seem to have a basic missunderstanding how the Splunk 4.1.3 Deployment Server works. I want to deploy a simple inputs.conf to a group of Splunk Forwarder.
I did already the following:
1.) Setup a Deployment Server (same as my searchhead)
2.) Defined serverclass.conf:
[serverClass:PUC-Linux-LWF]
filterType = whitelist
repositoryLocation = /opt/splunk-searchhead/splunk/etc/deployment-apps/PUC-Linux-LWF
whitelist.0 = *
3.) Enabled the deployment clients (as described). Handshaking is working:
*lfrprax@splunk-a:/opt/splunk-searchhead/splunk/bin# ./splunk list deploy-clients
Deployment client: ip=10.111.128.98, dns=splunk-a.puc.ov.otto.de, hostname=splunk-a, mgmt=8589, build=80534, name=deploymentClient, id=connection_10.111.128.98_8589_splunk-a.puc.ov.otto.de_splunk-a_deploymentClient, utsname=linux-x86_64
utsname: linux-x86_64
name: deploymentClient
ip: 10.111.128.98
hostname: splunk-a
build: 80534
dns: splunk-a.puc.ov.otto.de
mgmt: 8589
phoneHomeTime: Thu Aug 12 19:26:39 2010
id: connection_10.111.128.98_8589_splunk-a.puc.ov.otto.de_splunk-a_deploymentClient*
4.) Created the directories and the inputs.conf that i want to distribute:
*lfrprax@splunk-a:/opt/splunk-searchhead/splunk/etc/deployment-apps/PUC-Linux-LWF/default# cat inputs.conf
[monitor://$SPLUNK_HOME/var/log/splunk]
disabled = 1
index = idx_dev_splunk
#TEST*
5.) Reloading Deploy-Server:
*lfrprax@splunk-a:/opt/splunk-searchhead/splunk/bin# ./splunk reload deploy-server
Reloading server classes (and checking for any new or removed classes).*
Here´s my question...where is the new inputs.conf on my deployment client? I can´t find it!???
Please, help.