Deployment Architecture

augeas lenses for Splunk?

Path Finder

Has anyone written any Augeas lenses for Splunk? Would the generic ini lenses for the config files? Being able to use augeas + puppet to configure and deploy Splunk would be pretty rock star!

Path Finder

Yes, there is now a contributed Augeas lens that has not yet been released:

Combine that with the ability of Puppet 2.7.18 to sync Augeas lenses w/pluginsync and you're good to go:

(At least, in theory; I haven't tried either the lens or syncing lenses myself yet.)

Path Finder

Hey thats awesome! Have you had any luck writing to tags.conf? I copied a lens and got it working, but wasn't ever able to get it to correctly write to tags.conf, something about the equal symbol in the section header. I'll check out your lens too! Thanks for posting this!

0 Karma

Splunk Employee
Splunk Employee

I would say it's generally unnecessary to use automatic configuration file editors for Splunk, because the native configuration file mechanism in Splunk allows you to segment, overlay, merge and override settings by splitting a logical configuration file (e.g. props.conf) into many configuration files based on app (e.g., etc/apps/MYAPP1/local/props.conf, etc/apps/otherapp/default/props.conf, etc/system/default/props.conf, etc/system/local/props.conf), which are then all loaded and merged by Splunk itself.

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...