I have created a setup.xml file which i'm using as a custom config file for a splunk app.
The setup file contains 3 settings;
These settings are values which I would like to use throughout my dashboards and in turn these values are used across charts, for example using them as thresholds or used as tokens etc...
Now I have these inside myconf.conf who can I now retrieve them back to use within searches? is the myconf.conf file automatically imported into my app? so I can now easly treat each field as a token? for example, if I use $setting1$ would that retrieve it's value?
i'm using splunk 6.2.2 and also simple xml
Your help with this would be very much appreciated.
I personally would use a lookup table to achieve this. Place this data into a csv and import as a lookup file, create a lookup definition for it then if you like create an automatic lookup so you never need to do it again.
I did think of that, but I would like users to be able to edit these values easily if they need to.
Is there a way to achieve the returning of config file values?
The lookup file editor app would be a good solution to allow user to easily edit.
Thank you, I will do that. Is it as easy as returning a token if I use a lookup file?
If my field is settings1 - could I use $settings1$ to retrieve its value?
Have a look at the reference docs on lookup. Tokens aren't the real focus here. Take a look.