All Apps and Add-ons

Merging eventtypes.conf (and other config files).

nocostk
Communicator

Currently I have two separate search heads. I'm trying to consolidate my configuration files so I can make use of searchhead pooling new in v. 4.2. What would be the easiest way to do this? I could copy/paste but it looks a little daunting. I also need to synchronize the files in SPLUNK_HOME/etc/users. Does anyone have any suggestions?

1 Solution

bbingham
Builder

The hard thing about merging the files, is dealing with duplicates. Making direct copy and paste actions can be done really quickly through scripting or using rsync on *nix. rsync has an option to update a destination and append shorter files. You can also limit rsync into specific directories and might be a good trial path for you to head down. If you want the security knowing your conf files are 100% correct, I don't think you're getting around doing it by hand.

View solution in original post

0 Karma

bbingham
Builder

The hard thing about merging the files, is dealing with duplicates. Making direct copy and paste actions can be done really quickly through scripting or using rsync on *nix. rsync has an option to update a destination and append shorter files. You can also limit rsync into specific directories and might be a good trial path for you to head down. If you want the security knowing your conf files are 100% correct, I don't think you're getting around doing it by hand.

0 Karma

nocostk
Communicator

Alright - that's what I was afraid of. Thanks for your help, lephino.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...