Multiple conf files with single endpoint or referencing other conf files?

user4455 — Sun, 24 Jan 2016 18:25:49 GMT

I have an app with setup.xml where a hostname is entered. I've also made a custom conf file and setup the REST endpoint for it. A python script uses this info. This all works great.

However, I need workflow_actions.conf to also know about that hostname in the URL of an action (link.uri).

What's the best way to go about this in splunk?

Re: Multiple conf files with single endpoint or referencing other conf files?

lguinn2 — Mon, 25 Jan 2016 08:05:07 GMT

There is no way to get a configuration file to reference another configuration file, at least not in the way you describe.
However, Splunk has a way to store "state information" like a hostname. There are two variations.

First, you could write the information to a csv file stored in the lookups subdirectory, and set up the csv file as a lookup.
Or, you could write the information (as a collection) to the KV store and set up a lookup based on the collection.

Here is some documentation that may help:

Tutorial: Use KV Store with a simple app

Administer the app key value store

Use field lookups

topic Multiple conf files with single endpoint or referencing other conf files? in Knowledge Management

Multiple conf files with single endpoint or referencing other conf files?

Re: Multiple conf files with single endpoint or referencing other conf files?