topic Re: Splunk UF Docker edit props.conf file in Getting Data In

Splunk UF Docker edit props.conf file

eddiemashayev — Tue, 29 Sep 2020 19:20:02 GMT

Hey,

I want to be able to edit this file /opt/splunk/etc/system/default/props.conf and add this data input:
[journald]
KV_MODE = json
MAX_TIMESTAMP_LOOKAHEAD = 10
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TIME_FORMAT = %s
TIME_PREFIX = \"__REALTIME_TIMESTAMP\" : \"
pulldown_type = 1
TZ=UTC

I don't see any way to do it with SPLUNK_CMD
Also didn't find any documentation in https://hub.docker.com/r/splunk/splunk/

Please assist.

Re: Splunk UF Docker edit props.conf file

FrankVl — Wed, 02 May 2018 12:17:44 GMT

Not too familiar with the Docker approach, but in general, you should never, ever edit any config file in etc/system/default/.

Put the additional input configuration into a dedicated app, which you place in etc/apps/.

Re: Splunk UF Docker edit props.conf file

ddrillic — Wed, 02 May 2018 12:57:59 GMT

I also wonder which ones of these settings need to be on the indexer side...

Re: Splunk UF Docker edit props.conf file

eddiemashayev — Wed, 02 May 2018 13:07:33 GMT

Thanks for the answer, still I need to know how do I add this configuration in Docker UF.

Re: Splunk UF Docker edit props.conf file

FrankVl — Wed, 02 May 2018 13:09:28 GMT

Oh, didn't even spot that, but this kind of props.conf all goes onto the indexer (unless you use a heavy forwarder). I was a bit blinded by your "I want to ... add this data input". Inputs are usually defined in inputs.conf not props.conf.

Re: Splunk UF Docker edit props.conf file

eddiemashayev — Wed, 02 May 2018 13:27:23 GMT

I'm using Splunk Cloud and when add new source type called journald in the Splunk cloud it's not working unless I'm updating the UF as well with

[journald]
KV_MODE = json
MAX_TIMESTAMP_LOOKAHEAD = 10
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TIME_FORMAT = %s
TIME_PREFIX = \"__REALTIME_TIMESTAMP\" : \"
pulldown_type = 1
TZ=UTC

Is there any option to change it on the Splunk cloud only ?? and it will take effect?