augeas lenses for Splunk?

[thartmann]

Has anyone written any Augeas lenses for Splunk? Would the generic ini lenses for the config files? Being able to use augeas + puppet to configure and deploy Splunk would be pretty rock star!

[Wilcooley]

Yes, there is now a contributed Augeas lens that has not yet been released: https://fedorahosted.org/augeas/ticket/284

Combine that with the ability of Puppet 2.7.18 to sync Augeas lenses w/pluginsync and you're good to go: http://docs.puppetlabs.com/guides/plugins_in_modules.html

(At least, in theory; I haven't tried either the lens or syncing lenses myself yet.)

[thartmann]

Hey thats awesome! Have you had any luck writing to tags.conf? I copied a lens and got it working, but wasn't ever able to get it to correctly write to tags.conf, something about the equal symbol in the section header. I'll check out your lens too! Thanks for posting this!

[gkanapathy]

I would say it's generally unnecessary to use automatic configuration file editors for Splunk, because the native configuration file mechanism in Splunk allows you to segment, overlay, merge and override settings by splitting a logical configuration file (e.g. props.conf) into many configuration files based on app (e.g., etc/apps/MYAPP1/local/props.conf, etc/apps/otherapp/default/props.conf, etc/system/default/props.conf, etc/system/local/props.conf), which are then all loaded and merged by Splunk itself.

http://www.splunk.com/base/Documentation/latest/Admin/Aboutconfigurationfiles