topic Re: Retrieving values from config file in Dashboards & Visualizations

Retrieving values from config file

bmelim — Fri, 13 Mar 2015 14:39:37 GMT

Hi Guys,

I have created a setup.xml file which i'm using as a custom config file for a splunk app.
The setup file contains 3 settings;

setting1=5
setting2=40
setting3=10

These settings are values which I would like to use throughout my dashboards and in turn these values are used across charts, for example using them as thresholds or used as tokens etc...

Now I have these inside myconf.conf who can I now retrieve them back to use within searches? is the myconf.conf file automatically imported into my app? so I can now easly treat each field as a token? for example, if I use $setting1$ would that retrieve it's value?

i'm using splunk 6.2.2 and also simple xml

Your help with this would be very much appreciated.

Re: Retrieving values from config file

dolivasoh — Fri, 13 Mar 2015 20:34:02 GMT

I personally would use a lookup table to achieve this. Place this data into a csv and import as a lookup file, create a lookup definition for it then if you like create an automatic lookup so you never need to do it again.

Re: Retrieving values from config file

bmelim — Fri, 13 Mar 2015 21:19:26 GMT

I did think of that, but I would like users to be able to edit these values easily if they need to.
Is there a way to achieve the returning of config file values?

Re: Retrieving values from config file

dolivasoh — Fri, 13 Mar 2015 22:51:35 GMT

The lookup file editor app would be a good solution to allow user to easily edit.

Re: Retrieving values from config file

bmelim — Mon, 16 Mar 2015 13:37:57 GMT

Thank you, I will do that. Is it as easy as returning a token if I use a lookup file?
If my field is settings1 - could I use $settings1$ to retrieve its value?

Re: Retrieving values from config file

dolivasoh — Tue, 24 Mar 2015 19:54:15 GMT

Have a look at the reference docs on lookup. Tokens aren't the real focus here. Take a look.

http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Lookup