Deployment Architecture

merge indexes.conf files

kembgeorge
Loves-to-Learn

I have a task to take a list of active Indexes and create a new configuration file entry in a merged file, using a bunch of other configuration files. taking note of bucket size and what not 

can anyone help with that?

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use btool.

splunk btool --debug indexes list | grep -v "system\/default" | awk '{$1=""; print $0}' > myindexes.conf
---
If this reply helps you, Karma would be appreciated.
0 Karma

kembgeorge
Loves-to-Learn

thanks very much. what exactly will that Btool command do?

I appreciate the help let me see if i can clarify it a little bit more. ok I have two indexes.conf files right with a list of indexes in them and I want to merge those indexes to a new configuration file with all the similar indexes that i would like the new config file to have 

here is an example ok 

so  Aindexes.conf  and B indexes.conf have a list of indexes (1,2,3,4,5,6,7,8.) and  I want to merge all those indexes to a new index called merged index I will keep their internal, audit and some other indexes. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The command collects all indexes.conf information, strips out entries from $SPLUNK_HOME/etc/system/default, and then writes the resulting entries into a single indexes.conf file.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...