Conf File Variables

[jdmeek]

I'm reverse engineering UF configs from an old deploy server that we're replacing and am running into variables in conf files but I'm not finding where the values are defined. 

An example would be an if_ip in an outputs.conf entry...

[tcpout:primary_forwarders]
server = {{ hf_ip }}:9997

They look like custom variables as they would be used in Observability Cloud but this is in a standard Enterprise deploy.

[jdmeek]

After backing away for a bit, I'm guessing that this is supposed to serve as a template and should be commented out.

[livehybrid · Accepted solution]

Hi @jdmeek 

The syntax looks like its something like a Jinja2 template for an ansible deployed config, could this be the case here?

The following is an example of what a correct outputs.conf could look like:

[tcpout:primary_forwarders]
server = 10.0.14.129:9997

or

[tcpout:primary_forwarders]
server = splunkrcv.mycompany.com:9997,myotherhost.mycompany.com:9997

For more information on outputs.conf check out https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/9.4/configuration-file-ref... 

If you are seeing variables named if_ip as well as hf_ip then it would suggest you also have intermediate forwarders.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing