https://community.splunk.com/t5/Getting-Data-In/Can-these-ingestion-related-tasks-be-completed-through-the-REST/m-p/446683#M77694 <P>Our organization creates new indexes almost daily for one-off/one-shot logs from different customers we work with. This leads to a lot of overhead around creating inputs.conf, index.conf stanzas, the rare props.conf stanza for custom sourcetypes/logs and especially filesystem level access like creating the new batch directories on the forwarder.</P> <P>We are automating all of this but still have a few things that seem to need filesystem access. We are trying to avoid this type of access but can't seem to find other solutions for the following:</P> <OL> <LI>Moving the config files updated by the API from .../system/local/ to .../master-apps/_cluster/local on the Master.</LI> <LI>Creating the batch directories on the forwarder</LI> <LI>Pushing the log files to the batch directories on the forwarder</LI> </OL> <P>Is there any way to avoid these items? Is there a completely different way to do this considering the constant index/inputs/props creation requirements for various types of one-off logs?</P> Tue, 05 Jun 2018 21:10:06 GMT thisissplunk 2018-06-05T21:10:06Z https://community.splunk.com/t5/Getting-Data-In/Can-these-ingestion-related-tasks-be-completed-through-the-REST/m-p/446683#M77694 <P>Our organization creates new indexes almost daily for one-off/one-shot logs from different customers we work with. This leads to a lot of overhead around creating inputs.conf, index.conf stanzas, the rare props.conf stanza for custom sourcetypes/logs and especially filesystem level access like creating the new batch directories on the forwarder.</P> <P>We are automating all of this but still have a few things that seem to need filesystem access. We are trying to avoid this type of access but can't seem to find other solutions for the following:</P> <OL> <LI>Moving the config files updated by the API from .../system/local/ to .../master-apps/_cluster/local on the Master.</LI> <LI>Creating the batch directories on the forwarder</LI> <LI>Pushing the log files to the batch directories on the forwarder</LI> </OL> <P>Is there any way to avoid these items? Is there a completely different way to do this considering the constant index/inputs/props creation requirements for various types of one-off logs?</P> Tue, 05 Jun 2018 21:10:06 GMT https://community.splunk.com/t5/Getting-Data-In/Can-these-ingestion-related-tasks-be-completed-through-the-REST/m-p/446683#M77694 thisissplunk 2018-06-05T21:10:06Z