Deployment Architecture

augeas lenses for Splunk?

Path Finder

Has anyone written any Augeas lenses for Splunk? Would the generic ini lenses for the config files? Being able to use augeas + puppet to configure and deploy Splunk would be pretty rock star!

Path Finder

Yes, there is now a contributed Augeas lens that has not yet been released:

Combine that with the ability of Puppet 2.7.18 to sync Augeas lenses w/pluginsync and you're good to go:

(At least, in theory; I haven't tried either the lens or syncing lenses myself yet.)

Path Finder

Hey thats awesome! Have you had any luck writing to tags.conf? I copied a lens and got it working, but wasn't ever able to get it to correctly write to tags.conf, something about the equal symbol in the section header. I'll check out your lens too! Thanks for posting this!

0 Karma

Splunk Employee
Splunk Employee

I would say it's generally unnecessary to use automatic configuration file editors for Splunk, because the native configuration file mechanism in Splunk allows you to segment, overlay, merge and override settings by splitting a logical configuration file (e.g. props.conf) into many configuration files based on app (e.g., etc/apps/MYAPP1/local/props.conf, etc/apps/otherapp/default/props.conf, etc/system/default/props.conf, etc/system/local/props.conf), which are then all loaded and merged by Splunk itself.

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...