https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-App-for-Unix-Configuring/m-p/84230#M5409 <P>You can configure the Splunk <STRONG>Add-on</STRONG> for Unix and Linux from the command line. In fact, that's the only way you can configure the add-on.</P> <P>You can configure the Splunk <STRONG>App</STRONG> for Unix and Linux only from Splunk Web.</P> <P>We've updated the docs to clarify.</P> Mon, 07 Oct 2013 17:23:38 GMT ChrisG 2013-10-07T17:23:38Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-App-for-Unix-Configuring/m-p/84227#M5406 <P>One of the items on the doc page is confusing - <A href="http://docs.splunk.com/Documentation/UnixApp/latest/User/First-timeconfiguration">link text</A></P> <P>Important:</P> <P>You can not configure the Splunk App for Unix and Linux from the command line. You must use the Settings pages, described in detail in this topic.<BR /> Conversely, there is no way to configure the Splunk Add-on for Unix and Linux in any other way than the command line.</P> <P>Though the doc does point out this:<BR /> <CODE>Use the Settings: Categories page to add host categories and groups. When you make these changes, the Splunk App for Unix and Linux writes them to $SPLUNK_HOME/etc/apps/SA-nix/lookups/dropdowns.csv.</CODE></P> <P>Are we truly forced to use the UI only to configure the category/grouping? This would be a major pain.</P> Sun, 06 Oct 2013 03:04:01 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-App-for-Unix-Configuring/m-p/84227#M5406 mikelanghorst 2013-10-06T03:04:01Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-App-for-Unix-Configuring/m-p/84228#M5407 <P>My guess would be that anything that creates a sane .csv is fine, including vi. I'm not in a position to test that, so not posting this as an actual answer. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Sun, 06 Oct 2013 05:45:26 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-App-for-Unix-Configuring/m-p/84228#M5407 jspears 2013-10-06T05:45:26Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-App-for-Unix-Configuring/m-p/84229#M5408 <P>You can manually edit the file from the command line : $SPLUNK_HOME/etc/apps/SA-nix/lookups/dropdowns.csv</P> <P>The format of this file is </P> <PRE><CODE>host,unix_category,unix_group some_example_host,some__example_category,some_example_group </CODE></PRE> Sun, 06 Oct 2013 22:38:29 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-App-for-Unix-Configuring/m-p/84229#M5408 Lucas_K 2013-10-06T22:38:29Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-App-for-Unix-Configuring/m-p/84230#M5409 <P>You can configure the Splunk <STRONG>Add-on</STRONG> for Unix and Linux from the command line. In fact, that's the only way you can configure the add-on.</P> <P>You can configure the Splunk <STRONG>App</STRONG> for Unix and Linux only from Splunk Web.</P> <P>We've updated the docs to clarify.</P> Mon, 07 Oct 2013 17:23:38 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-App-for-Unix-Configuring/m-p/84230#M5409 ChrisG 2013-10-07T17:23:38Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-App-for-Unix-Configuring/m-p/84231#M5410 <P>Lucas K is correct, you can edit the file from the CLI, using your favorite CSV editor, or have a saved search update the values. A few important things to consider:</P> <UL> <LI>make sure you retain the column order: host, unix_category, unix_group</LI> <LI>make sure you delete the default entry of "*,all_hosts,default" before you add any other entries</LI> </UL> Mon, 28 Sep 2020 14:54:57 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-App-for-Unix-Configuring/m-p/84231#M5410 araitz 2020-09-28T14:54:57Z