Install the Effective Configuration add-on

By default, the Effective Configuration add-on is not installed on agents. To use it, download the add-on from Splunkbase, install it on the agent management server, and then deploy it to your agents. For more information about deploying apps, see Deploy apps to agents.

Note: Before you begin, make sure that you use agent management version 10.0 or higher.
  1. Download Splunk_TA_effective_configuration from Splunkbase.
  2. Untar the .tgz file into the etc/deployment-apps directory.

    You have to create an app directory for the agent management to distribute this add-on. The default location is $SPLUNK_HOME/etc/deployment-apps, but this is configurable through the repositoryLocation attribute in serverclass.conf. For more information, see Create the app directories.

  3. Log in to Splunk Enterprise.
  4. Select the settings icon (Settings), and then under the Distributed Environment section, select Agent management.

    The Agent management page opens.

  5. On the Agent Management page, go to the Applications tab. In the list of applications, you can see Splunk_TA_effective_configuration. Its deployment status is set to Not Deployed.

(Optional) Reduce the size of the Effective Configuration add-on

Before you deploy the add-on, you can reduce its size by removing directories that are not used for the target platform. Depending on your needs, you can remove the following directories:
  • aix*
  • darwin*
  • freebsd*
  • linux*
  • solaris*
  • windows*

For example, if you use this add-on only on the linux_arm64 platform, you can remove the following directories: windows_x86_64, windows_x86, solaris_amd64, linux_x86_64, linux_s390x, linux_ppc64le, freebsd_amd64, darwin_x86_64, darwin_arm64, and aix_ppc64.

Deploy the Effective Configuration add-on to agents

  1. To deploy the Effective Configuration add-on, go to the Server Classes tab.
  2. Create a new server class, and then add the Effective Configuration add-on to this server class to install it on agents.
    Note: You have to add the add-on to at least 1 server class in order to be able to edit this application.
  3. On the Server classes page, go to the Applications tab and select Edit applications.
  4. On the Edit applications page, in the Unassigned Applications section, select Splunk_TA_effective_configuration.
  5. Select the right arrow to move the selected application to the Assigned Applications section.
  6. Select Save. The application is sent when the agent phonehome is sent from the agent. When the application is saved, the Applications tab displays.
  7. In the table, select Splunk_TA_effective_configuration.
  8. In the Details tab, update these settings:
    1. Select the Enable application option.
    2. Turn on the Restart agent toggle.
  9. Add agents to the server class and wait for the add-on installation to complete:
    1. Go to the Agent Management page and then go to the Server Classes tab.
    2. Select a server class to which you want to add agents.
    3. Go to the Agents tab and select Edit agents. For more details about possible actions in this page, see Specify agents.
    4. Specify the agents you want in the server class, and then select Save.
  10. After the deployment is complete, typically within 1 phonehome period, you can access the effective configuration used on agents. For more information, see View configurations installed on agents.

Data collection interval

After deployment, the add-on collects effective configuration data from agents at a regular interval defined by the scripted input in the add-on inputs.conf file.

To change the collection interval, update the interval setting in the inputs.conf file within the deployed add-on. For example, to collect data every 15 minutes, set:

CODE 
interval = 900
Note: Decreasing the interval increases the frequency of data collection but also increases the load on your agents. Choose an interval that balances data freshness with system performance.

Verify that the Effective Configuration add-on is installed

Note: The add-on installation is tied to the phonehome interval. A higher phoneHomeIntervalInSecs value means the configuration change, such as an application change, takes up to that amount of time to apply.
  1. To check if the Effective Configuration add-on is installed, on the Server classes page, go to the Agents tab and select an agent.
  2. On the Agents page, go to the Applications tab and check that the status of the Splunk_TA_effective_configuration add-on is set to Deployed.