All Apps and Add-ons

Merging eventtypes.conf (and other config files).

nocostk
Communicator

Currently I have two separate search heads. I'm trying to consolidate my configuration files so I can make use of searchhead pooling new in v. 4.2. What would be the easiest way to do this? I could copy/paste but it looks a little daunting. I also need to synchronize the files in SPLUNK_HOME/etc/users. Does anyone have any suggestions?

1 Solution

bbingham
Builder

The hard thing about merging the files, is dealing with duplicates. Making direct copy and paste actions can be done really quickly through scripting or using rsync on *nix. rsync has an option to update a destination and append shorter files. You can also limit rsync into specific directories and might be a good trial path for you to head down. If you want the security knowing your conf files are 100% correct, I don't think you're getting around doing it by hand.

View solution in original post

0 Karma

bbingham
Builder

The hard thing about merging the files, is dealing with duplicates. Making direct copy and paste actions can be done really quickly through scripting or using rsync on *nix. rsync has an option to update a destination and append shorter files. You can also limit rsync into specific directories and might be a good trial path for you to head down. If you want the security knowing your conf files are 100% correct, I don't think you're getting around doing it by hand.

0 Karma

nocostk
Communicator

Alright - that's what I was afraid of. Thanks for your help, lephino.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...