topic Re: Practices when reading/writing .conf files in Getting Data In

Practices when reading/writing .conf files

klausJohan — Mon, 28 Sep 2020 14:57:30 GMT

Hi,

In the Splunk App I am working on , there is a need to specify some parameters through UI, persist them and later on read/update them. Since the "setup screen" doesn't provide me all the flexibility I need I've looked for other options. Eventually I realized that by using a custom controller and reading/writing some .conf files I can obtain what I need. However the tricky part is manipulating those files. Reading content created no problems , with the following code

      import splunk.bundle as bundle


       dict = {}
        try:
            conf = bundle.getConf(self.MY_CONF_FILE)
            for stanza in conf:
                logger.info("stanza : "+stanza )
                dict[stanza] = {}
                dict[stanza].update(conf[stanza].items())
        except splunk.ResourceNotFound:
            pass

Writing on the other hand , done though the Splunk bundle proved to offer something else then desired. The content was written in a version of MY_CONF_FILE located somewhere else then ".../myApp/default" directory (perhaps "..../system/local", it's a while since I've tried it). So In my intention to persist some configuration I realized that I was reading from a file and writing to another file, therefore subsequent reads would not bring previous writes.

Here's the code used to write

 conf = bundle.getConf(self.MY_CONF_FILE)
    conf.beginBatch()
    conf['STANZA']['setting_1'] = value_1
    conf['STANZA']['setting_2'] = value_2
    conf['STANZA']['setting_3'] = value_3
    conf.commitBatch()

Therefore I resorted to use ConfigParser for reading/writing .conf files , without doing it through Splunk.

def writeMacrosConfFile(self,statisticsPort):
   writeSuccesfull = True       
    try:
        parser = ConfigParser.SafeConfigParser()
        parser.read(MACROS_CONF_FILE)
        parser.set(MACRO_PORT_STANZA, DEFINITION, statisticsPort)   
        with open(MACROS_CONF_FILE, 'wb') as configfile:
            parser.write(configfile)
    except Exception as e:
        writeSuccesfull = False

This is done for both custom .conf files and the macros.conf file

The question would be if there is something wrong in manipulating the .conf files like this since I am feeling it is not according to the Splunk way ? Would this kind of code render the Splunk app unacceptable for uploading in Splunkbase ?

Also any feedback on reading/writing .conf files would be greatly welcomed.

Re: Practices when reading/writing .conf files

klausJohan — Mon, 04 Nov 2013 10:50:26 GMT

I submitted the app including the custom/system conf files manipulation using ConfigParser and the result is that it got accepted. So I guess this is acceptable. Hope it will help the next person having the same dilema as I did.

Cheers

Re: Practices when reading/writing .conf files

sbaryakov — Mon, 04 Nov 2013 11:10:22 GMT

You may think of preserving the case if the config that you are working with is also touched by splunk, such as server.conf or web.conf and so on(parser_obj.optionxform = str). Otherwise my experience is that it is fine to use python's ConfigParser.

Greetings
-Stefan

Re: Practices when reading/writing .conf files

ragingwire — Wed, 25 Feb 2015 00:24:38 GMT

I was looking for the same thing. I also found this:
http://answers.splunk.com/answers/69438/retrieve-configuration-items-from-a-custom-python-search-command.html

Re: Practices when reading/writing .conf files

halr9000 — Wed, 25 Feb 2015 13:34:10 GMT

You may also want to check out the new KV store feature. We are using this for config state in the latest versions of ES, Windows Infrastructure, and other apps in the future.