All Apps and Add-ons

Merging eventtypes.conf (and other config files).

nocostk
Communicator

Currently I have two separate search heads. I'm trying to consolidate my configuration files so I can make use of searchhead pooling new in v. 4.2. What would be the easiest way to do this? I could copy/paste but it looks a little daunting. I also need to synchronize the files in SPLUNK_HOME/etc/users. Does anyone have any suggestions?

1 Solution

bbingham
Builder

The hard thing about merging the files, is dealing with duplicates. Making direct copy and paste actions can be done really quickly through scripting or using rsync on *nix. rsync has an option to update a destination and append shorter files. You can also limit rsync into specific directories and might be a good trial path for you to head down. If you want the security knowing your conf files are 100% correct, I don't think you're getting around doing it by hand.

View solution in original post

0 Karma

bbingham
Builder

The hard thing about merging the files, is dealing with duplicates. Making direct copy and paste actions can be done really quickly through scripting or using rsync on *nix. rsync has an option to update a destination and append shorter files. You can also limit rsync into specific directories and might be a good trial path for you to head down. If you want the security knowing your conf files are 100% correct, I don't think you're getting around doing it by hand.

0 Karma

nocostk
Communicator

Alright - that's what I was afraid of. Thanks for your help, lephino.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...