Deployment Architecture

merge indexes.conf files

kembgeorge
Loves-to-Learn

I have a task to take a list of active Indexes and create a new configuration file entry in a merged file, using a bunch of other configuration files. taking note of bucket size and what not 

can anyone help with that?

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use btool.

splunk btool --debug indexes list | grep -v "system\/default" | awk '{$1=""; print $0}' > myindexes.conf
---
If this reply helps you, Karma would be appreciated.
0 Karma

kembgeorge
Loves-to-Learn

thanks very much. what exactly will that Btool command do?

I appreciate the help let me see if i can clarify it a little bit more. ok I have two indexes.conf files right with a list of indexes in them and I want to merge those indexes to a new configuration file with all the similar indexes that i would like the new config file to have 

here is an example ok 

so  Aindexes.conf  and B indexes.conf have a list of indexes (1,2,3,4,5,6,7,8.) and  I want to merge all those indexes to a new index called merged index I will keep their internal, audit and some other indexes. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The command collects all indexes.conf information, strips out entries from $SPLUNK_HOME/etc/system/default, and then writes the resulting entries into a single indexes.conf file.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...