topic Re: merging local into default using git in Splunk Search

Merging local into default using git?

dominiquevocat — Thu, 10 Nov 2022 15:21:47 GMT

I would like to periodically merge stuff in /local into /default and then delete whatever is in /local
I have a repository per app and a remote git server
I think it should be possible to merge these two subfolders with /local winning over /default but i am severely lacking in git knowledge so please be gentle 🙂

clarification:
The idea is to merge UI generated changes back into default (on INTG), push it to the central git and then pull the repo version to a splunk PROD stage ( /etc/apps or /etc/deployment-apps or /etc/cluster-apps or whatever was the path again).

Mostly for app maintainers updating searches and knowledge objects on the GUI with no shell access.

Re: merging local into default using git

koshyk — Mon, 10 Apr 2017 12:56:18 GMT

hi mate, why you merge into "default" ? Better to keep within "local" of your app.
You doing this for SH cluster?

Also the merging shouldn't be done using git, but you should look into btool

Re: merging local into default using git

DMohn — Mon, 10 Apr 2017 12:56:41 GMT

It is generally not recommended to have your local changes in the default folder, as any App Update will break your individual settings.

Are there any special reasons for you to not keep the local configs?

Re: merging local into default using git

dominiquevocat — Mon, 10 Apr 2017 13:01:08 GMT

The idea is to merge UI generated changes back into default (on INTG), push it to the central git and then pull the repo version to a splunk PROD stage ( /etc/apps or /etc/deployment-apps or /etc/cluster-apps or whatever was the path again).

Mostly for app maintainers updating searches and knowledge objects on the GUI with no shell access.

I will update the question to clarify

Re: merging local into default using git

dominiquevocat — Mon, 10 Apr 2017 13:01:58 GMT

open for pointers

essentially i want to merge all changes by non admins with shell and vi 🙂 into the default

Re: merging local into default using git

martin_mueller — Mon, 10 Apr 2017 13:24:43 GMT

You can use Splunk for the merge, call the /services/apps/local/<name>/package endpoint to generage a .spl file with local and default merged together into default.

To be lazy, you can use the App Exporter: https://splunkbase.splunk.com/app/2613/

Re: merging local into default using git

dominiquevocat — Mon, 10 Apr 2017 15:12:35 GMT

ok, but this won't touch the app itself so i can not work with git directly etc.

Re: merging local into default using git

martin_mueller — Mon, 10 Apr 2017 19:19:52 GMT

I don't see why not. Package app, put content of .spl wherever you commit to git from, commit to git.

Re: merging local into default using git

dominiquevocat — Thu, 13 Apr 2017 08:16:19 GMT

hm, yeah kinda look ok-ish. The idea was to work with a repository equaling an app and work directly with it in /etc/apps for instance.

The general workflow is supposed to be
1. fork app from template in bitbucket
2. clone repo into /etc/apps (or /etc/deployment-apps or /etc/master-apps) on a development stage
3. edit the app, in the case of an ui app via splunk web-ui (power users)
4. merge changes, clean stuff in local
5. push changes into git
6. clone or update app into a production stage into the apropriate structure and refresh leading to usable app in ui or app being deployed via cluster or deployment method

we keep a separate gitdir so there is no git cluter in the repo itself.

Do i make sense?

I guess i can do what you suggest and take the "detour" via /package of which i was not aware

Re: merging local into default using git

martin_mueller — Thu, 13 Apr 2017 09:14:15 GMT

It makes sense, I'm just not aware of something apart from the package endpoint that has the local-to-default merge logic already built.

Re: merging local into default using git

dominiquevocat — Fri, 25 Aug 2017 20:49:51 GMT

ok, so i ended up doing my custom command and its up for grabs at https://splunkbase.splunk.com/app/3685/

Re: merging local into default using git

dominiquevocat — Fri, 25 Aug 2017 20:50:15 GMT

If you face the same issue just use the new custom command mergeapp in https://splunkbase.splunk.com/app/3685/

Re: merging local into default using git

martin_mueller — Fri, 25 Aug 2017 21:21:19 GMT

Isn't that a little light on cleaning up /local? E.g. eventtypes.conf, tags.conf, fields.conf, etc.

Re: merging local into default using git

dominiquevocat — Tue, 29 Sep 2020 15:32:52 GMT

yeah i think this would be a better default set:
(from line 47:)

os.remove(os.path.join(appsPath,appName,'local','alert_actions.conf'))
os.remove(os.path.join(appsPath,appName,'local','authentication.conf'))
os.remove(os.path.join(appsPath,appName,'local','authorize.conf'))
os.remove(os.path.join(appsPath,appName,'local','commands.conf'))
os.remove(os.path.join(appsPath,appName,'local','database.conf'))
os.remove(os.path.join(appsPath,appName,'local','datamodels.conf'))
os.remove(os.path.join(appsPath,appName,'local','db_connection_types.conf'))
os.remove(os.path.join(appsPath,appName,'local','db_connections.conf'))
os.remove(os.path.join(appsPath,appName,'local','dblookup.conf'))
os.remove(os.path.join(appsPath,appName,'local','distsearch.conf'))
os.remove(os.path.join(appsPath,appName,'local','event_renderers.conf'))
os.remove(os.path.join(appsPath,appName,'local','eventgen.conf'))
os.remove(os.path.join(appsPath,appName,'local','eventtypes.conf'))
os.remove(os.path.join(appsPath,appName,'local','fields.conf'))
os.remove(os.path.join(appsPath,appName,'local','identities.conf'))
os.remove(os.path.join(appsPath,appName,'local','indexes.conf'))
os.remove(os.path.join(appsPath,appName,'local','inputs.conf'))
os.remove(os.path.join(appsPath,appName,'local','java.conf'))
os.remove(os.path.join(appsPath,appName,'local','limits.conf'))
os.remove(os.path.join(appsPath,appName,'local','macros.conf'))
os.remove(os.path.join(appsPath,appName,'local','outputs.conf'))
os.remove(os.path.join(appsPath,appName,'local','props.conf'))
os.remove(os.path.join(appsPath,appName,'local','restmap.conf'))
os.remove(os.path.join(appsPath,appName,'local','savedsearches.conf'))
os.remove(os.path.join(appsPath,appName,'local','searchbnf.conf'))
os.remove(os.path.join(appsPath,appName,'local','server.conf'))
os.remove(os.path.join(appsPath,appName,'local','settings.conf'))
os.remove(os.path.join(appsPath,appName,'local','tags.conf'))
os.remove(os.path.join(appsPath,appName,'local','telemetry.conf'))
os.remove(os.path.join(appsPath,appName,'local','transforms.conf'))
os.remove(os.path.join(appsPath,appName,'local','ui-prefs.conf'))
os.remove(os.path.join(appsPath,appName,'local','user-prefs.conf'))
os.remove(os.path.join(appsPath,appName,'local','viewstates.conf'))
os.remove(os.path.join(appsPath,appName,'local','visualizations.conf'))
os.remove(os.path.join(appsPath,appName,'local','web.conf'))
os.remove(os.path.join(appsPath,appName,'local','workflow_actions.conf'))

Re: merging local into default using git

dominiquevocat — Sat, 23 Sep 2017 17:16:11 GMT

i updated it for .conf - it just checks what .spec files are under system and clears those.

Re: merging local into default using git

bjoernhansen — Fri, 15 Dec 2017 10:24:26 GMT

As this is a top result on Google when searching for this issue, I'd like to offer an alternative way I found, using a 3rd party tool called crudini.

Splunk config files work well enough with that tool, so if you don't want to create a complete "packaged" app, but just combine two Splunk config files, with no restriction if they're in the same app, use crudini - at least for RedHat, it's available from the EPEL repo, and also available in Debian.

crudini works like this:

crudini --merge default/props.conf < local/props.conf

The result is a .conf file, that contains the data from the default props, updated and completed by whatever is available in the local props file. It can obviously also be used to set/change/delete values in Splunk conf files from within your scripts.

Disclaimer: I did not yet properly test it with all edge cases, e.g. multiline values. Use at your own discretion 😉

Re: merging local into default using git

dominiquevocat — Fri, 15 Dec 2017 12:34:27 GMT

Sounds cool, i can have a look at it. a pure python way would be nice...
I have a semi working git (pure python) for splunk but it is not yet totaly nice. if anyone is interested...

Re: merging local into default using git

bjoernhansen — Fri, 15 Dec 2017 12:38:22 GMT

Well, for Python, check the ConfigParser package. 😉

Re: merging local into default using git

Lowell — Fri, 28 Sep 2018 20:31:09 GMT

So I know I'm a bit late to the party here, but wanted to throw out another option that I've found useful. Now, as a disclaimer, I'm a bit biased since I'm the author.

I've written a tool called ksconf that we use in our consulting practice to handle this type of scenario for our clients. It handles several basic .conf file operations like merging, comparing, sorting, and syntax checking. But besides these simple operations, it has the ability to manage an arbitrary number of configuration layers (more than the 2 provided by Splunk - default & local); so issues like maintaining a long-term changes on top of an app that originated in Splunkbase and tracking both your customizations and upstream changes simultaneously is possible without turning the "default" folder into a version control nightmare. There's also a promotion feature that I use to take and move changes that I've made via the UI (which go into the local folder) and then "promote" those specific changes into a folder that's version controlled. (For me, this has cut down on mistakes introduced while editing both local and default files manually in vim.) The tool lets me pick and choose which bits are promoted and which ones are kept in local (because they are either specific to the local dev system, or because they are still being developed.)

Another great feature is pre-commit hook integration, so for example you can have all of your .conf files syntax checked before they get committed. This has saved me from myself on many occasions.

So you can use this tool to do simple things (much like what I suspect crudini can do), or you can integrate it into your git workflow, or use it to do much more extensive work like maintaining multiple layers of config files (giving you a "default.d" like feature), it's entirely up to you.

BTW, I have a talk at the Splunk User Community Experience during .conf2018 in a few days. Feel free to check it out.

Re: merging local into default using git

dominiquevocat — Fri, 28 Sep 2018 23:53:53 GMT

Hi, would love to talk about it some if you have time. I am at .conf already (university) - any chance to meet for chat?