Deployment Architecture

augeas lenses for Splunk?

Path Finder

Has anyone written any Augeas lenses for Splunk? Would the generic ini lenses for the config files? Being able to use augeas + puppet to configure and deploy Splunk would be pretty rock star!

Path Finder

Yes, there is now a contributed Augeas lens that has not yet been released:

Combine that with the ability of Puppet 2.7.18 to sync Augeas lenses w/pluginsync and you're good to go:

(At least, in theory; I haven't tried either the lens or syncing lenses myself yet.)

Path Finder

Hey thats awesome! Have you had any luck writing to tags.conf? I copied a lens and got it working, but wasn't ever able to get it to correctly write to tags.conf, something about the equal symbol in the section header. I'll check out your lens too! Thanks for posting this!

0 Karma

Splunk Employee
Splunk Employee

I would say it's generally unnecessary to use automatic configuration file editors for Splunk, because the native configuration file mechanism in Splunk allows you to segment, overlay, merge and override settings by splitting a logical configuration file (e.g. props.conf) into many configuration files based on app (e.g., etc/apps/MYAPP1/local/props.conf, etc/apps/otherapp/default/props.conf, etc/system/default/props.conf, etc/system/local/props.conf), which are then all loaded and merged by Splunk itself.

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...