All Apps and Add-ons
Highlighted

Merging eventtypes.conf (and other config files).

Communicator

Currently I have two separate search heads. I'm trying to consolidate my configuration files so I can make use of searchhead pooling new in v. 4.2. What would be the easiest way to do this? I could copy/paste but it looks a little daunting. I also need to synchronize the files in SPLUNK_HOME/etc/users. Does anyone have any suggestions?

Highlighted

Re: Merging eventtypes.conf (and other config files).

Builder

The hard thing about merging the files, is dealing with duplicates. Making direct copy and paste actions can be done really quickly through scripting or using rsync on *nix. rsync has an option to update a destination and append shorter files. You can also limit rsync into specific directories and might be a good trial path for you to head down. If you want the security knowing your conf files are 100% correct, I don't think you're getting around doing it by hand.

View solution in original post

0 Karma
Highlighted

Re: Merging eventtypes.conf (and other config files).

Communicator

Alright - that's what I was afraid of. Thanks for your help, lephino.

0 Karma