It's A and B. On forwarder management you assigned server classes and apps, but adding a new input would be done by editing the inputs.conf on the DS, not using the Forwarder Management web interface.
Agreed A and B. Quoting the Reference URL https://docs.splunk.com/Documentation/Forwarder/7.3.1/Forwarder/
HowtoforwarddatatoSplunkEnterprise#Define_inputs_on_the_universal_forwarder_with_configuration_files
"You can collect data on the universal forwarder using several methods. Define inputs on the universal forwarder with the CLI. You can use the CLI to define inputs on the universal forwarder. After you define the inputs, the universal forwarder collects data based on those definitions as long as it has access to the data that you want to monitor.
Define inputs on the universal forwarder with configuration files. If the input you want to configure does not have a CLI argument for it, you can configure inputs with configuration files. Create an inputs.conf file in the directory, $SPLUNK_HOME/etc/system/local
This needs more upvotes. The main purpose of the forwarder manager is to create server classes and overview the deployment. If you want to change the inputs, you do it via CLI on the forwarder, or change the settings in the inputs.conf file in the associated app on the DS which then will automatically update the settings on the forwarder after some phone home interval.
This is what the Add Data does on the Web UI, i.e., updates/creates the inputs.conf in the deployable app on the DS. It then automatically deploys/re-deploys the app to the remote forwarder.
Agreed. CLI, inputs.conf editing, and via Deployment Server (forwarder maangement).
Source: "Configure the universal forwarder to send data to Splunk Enterprise
" section at https://docs.splunk.com/Documentation/Forwarder/latest/Forwarder/HowtoforwarddatatoSplunkEnterprise
A,B and D, you cna see the below notes in data admin pdf
Add inputs on forwarders, by either:
- Editing inputs.conf manually
- Using Deployment Server
- Running Splunk commands (CLI)
I would say options AB and D
===
Add inputs on forwarders, by either:
- Editing inputs.conf manually
- Using Deployment Server
- Running Splunk commands (CLI)
====
If you already have an input set up for a different forwarder then you can add that same input to a different forwarder using Forwarder Management. My answer is A, B and D
I think it's A, B and D. That's what Forwarder Management is for - to set up the inputs.conf file on the Deployment Server to push out to your Forwarders. Forwarder Management lets you set the apps (what this question is talking about), set the clients, and define the server classes that connect them together
Forwarder Management is no right, answer is A and B. This is because we can add a forward via Deployment Manager but it is no the same that the Forwarder Manager that is used to create server classes and send apps.
The correct answer is A & B. Please see the reference for clarification - https://docs.splunk.com/Documentation/Forwarder/8.2.1/Forwarder/HowtoforwarddatatoSplunkEnterprise
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
AngusBlack
Highly Voted 3 years, 10 months agoucsdmiami2020
3 years, 7 months agoHamiltonian
3 years, 10 months agoHamiltonian
3 years, 10 months agotoney_mu
2 years, 2 months agokhyoung7410
Highly Voted 4 years, 5 months agoHamiltonian
3 years, 10 months agonewrose
4 years, 5 months agotoney_mu
2 years, 2 months agoyashgoel
Most Recent 6 months, 2 weeks agotoney_mu
2 years, 2 months agoemlch
2 years, 7 months agocagdaskarabag
2 years, 9 months agomarda
2 years, 11 months agothissiteisgreat
3 years agoRichieL
3 years agoApis
3 years, 4 months agoaallpp
3 years, 4 months agoM9201715
3 years, 5 months agoSunny38
3 years, 8 months agoBengieQuesada
3 years, 8 months agohesbee
3 years, 9 months agonavotfk
3 years, 10 months agoZeusP
3 years, 11 months ago