Archive
Highlighted

Is there a way to configure Splunk to index its own .conf files or does Splunk already do this?

Motivator

How can I configure Splunk to index its own conf files? Would there be any issues with doing this?

Or does Splunk already index those files, and if so, then where are they indexed?

0 Karma
Highlighted

Re: Is there a way to configure Splunk to index its own .conf files or does Splunk already do this?

SplunkTrust
SplunkTrust

In my belief, Splunk doesn't index the conf files. If you would like to index the conf files to track the change history on them, you can setup a monitor on different locations where .conf files can be present (etc/system, etc/apps, etc/users).
As far as I know there shouldn't be any issue monitoring .conf files.

0 Karma
Highlighted

Re: Is there a way to configure Splunk to index its own .conf files or does Splunk already do this?

Motivator
0 Karma
Highlighted

Re: Is there a way to configure Splunk to index its own .conf files or does Splunk already do this?

Motivator

Added to inputs.conf:

[monitor://C:\Program Files\Splunk\etc\...\*.conf]
sourcetype = conf
index = si_conf
LINE_BREAKER=^\[
followTail = False

...*.conf looks at all subdirectories for any files with conf extensions.
^[ breaks events before each stanza
followTail was just added to get the entire file indexed each time. Haven't verified it yet.

0 Karma
Highlighted

Re: Is there a way to configure Splunk to index its own .conf files or does Splunk already do this?

Motivator

If you use the SOS app it index the .conf files by default.

0 Karma
Highlighted

Re: Is there a way to configure Splunk to index its own .conf files or does Splunk already do this?

Motivator

I have SOS. Where can I see SOS indexing the conf files?

0 Karma
Highlighted

Re: Is there a way to configure Splunk to index its own .conf files or does Splunk already do this?

Motivator

The third tab, "Configuration File Viewer"

0 Karma
Highlighted

Re: Is there a way to configure Splunk to index its own .conf files or does Splunk already do this?

Motivator

I see the Configuration File Viewer, but I can't see the search that powers the stanza listing. Where is the information being indexed? ie: index=conf ... I am suspecting that it is not being indexed.

0 Karma
Highlighted

Re: Is there a way to configure Splunk to index its own .conf files or does Splunk already do this?

Motivator

Confirming that the Configuration File Viewer uses btool to pull the data but does not index anything. We have to create searches with btools to send the data to summary indexes ourselves.

0 Karma
Highlighted

Re: Is there a way to configure Splunk to index its own .conf files or does Splunk already do this?

Splunk Employee
Splunk Employee

If you just want to review the parameter in conf, try this app https://apps.splunk.com/app/2615/

0 Karma