topic Re: Merging eventtypes.conf (and other config files). in All Apps and Add-ons

Merging eventtypes.conf (and other config files).

nocostk — Mon, 25 Apr 2011 20:24:18 GMT

Currently I have two separate search heads. I'm trying to consolidate my configuration files so I can make use of searchhead pooling new in v. 4.2. What would be the easiest way to do this? I could copy/paste but it looks a little daunting. I also need to synchronize the files in SPLUNK_HOME/etc/users. Does anyone have any suggestions?

Re: Merging eventtypes.conf (and other config files).

bbingham — Tue, 26 Apr 2011 23:48:46 GMT

The hard thing about merging the files, is dealing with duplicates. Making direct copy and paste actions can be done really quickly through scripting or using rsync on *nix. rsync has an option to update a destination and append shorter files. You can also limit rsync into specific directories and might be a good trial path for you to head down. If you want the security knowing your conf files are 100% correct, I don't think you're getting around doing it by hand.

Re: Merging eventtypes.conf (and other config files).

nocostk — Thu, 28 Apr 2011 14:42:40 GMT

Alright - that's what I was afraid of. Thanks for your help, lephino.