All Apps and Add-ons

Merging eventtypes.conf (and other config files).

nocostk
Communicator

Currently I have two separate search heads. I'm trying to consolidate my configuration files so I can make use of searchhead pooling new in v. 4.2. What would be the easiest way to do this? I could copy/paste but it looks a little daunting. I also need to synchronize the files in SPLUNK_HOME/etc/users. Does anyone have any suggestions?

1 Solution

bbingham
Builder

The hard thing about merging the files, is dealing with duplicates. Making direct copy and paste actions can be done really quickly through scripting or using rsync on *nix. rsync has an option to update a destination and append shorter files. You can also limit rsync into specific directories and might be a good trial path for you to head down. If you want the security knowing your conf files are 100% correct, I don't think you're getting around doing it by hand.

View solution in original post

0 Karma

bbingham
Builder

The hard thing about merging the files, is dealing with duplicates. Making direct copy and paste actions can be done really quickly through scripting or using rsync on *nix. rsync has an option to update a destination and append shorter files. You can also limit rsync into specific directories and might be a good trial path for you to head down. If you want the security knowing your conf files are 100% correct, I don't think you're getting around doing it by hand.

0 Karma

nocostk
Communicator

Alright - that's what I was afraid of. Thanks for your help, lephino.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...