topic Re: Environment variable used in search in Splunk Search

Environment variable used in search

fresned — Fri, 29 Jul 2011 12:59:42 GMT

How do you set up an Environment variable to be used as part of the path for your data?
I set an environment variable on the system and when I try and use the environment variable I receive an error. The error is :Encountered the following error while trying to save :in handler: machine name: Parameter name : Path must be absolute. The default datasources splunk uses have a set Environment variable as part of there location: $SPLUNK_HOME/etc/splunk.version. Any assistance would be great.

Re: Environment variable used in search

mw — Fri, 29 Jul 2011 16:06:40 GMT

Do you mean within the context of an input?

# inputs.conf
[monitor://$SPLUNK_HOME/etc/apps/cisco/logs/cisco_firewall.log]

Re: Environment variable used in search

fresned — Fri, 29 Jul 2011 16:36:39 GMT

Yes where and how is $SPLUNK_HOME defined. I'm trying to define a value $FOO. in the bash shell i have defined export FOO='/opt/test/test1/' I can echo $FOO and get /opt/test/test1/. but splunk returns the error in handler: machine name: Parameter name : Path must be absolute

Re: Environment variable used in search

mw — Fri, 29 Jul 2011 19:48:59 GMT

Try setting your variable in $SPLUNK_HOME/etc/splunk-launch.conf and restarting. That may do it.