Getting Data In

Can I reference $SPLUNK_HOME in an inputs.conf or props.conf stanza?

dbryan
Path Finder

I want to do something like this:

# inputs.conf
[monitor://$SPLUNK_HOME/etc/apps/myapp/tmp]

And/or:

# props.conf
[source::$SPLUNK_HOME/etc/apps/myapp/tmp/*.log]

Is this possible?

It's basically so that an app does not have to be aware of its location on the filesystem, and so that I can run many instances of Splunk with the app installed on a single system without them stepping upon each other.

Tags (2)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

The former will work (inputs.conf monitor stanza header) but the latter will not (props.conf). However, you shouldn't really need the one in props.conf, as you can certainly just match the end of the filename pattern ([source::.../etc/apps/myapp/tmp/*.log]), or better yet, assign your files a sourcetype in the input and use that to set properties.

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!