Can I reference $SPLUNK_HOME in an inputs.conf or props.conf stanza?

[dbryan]

I want to do something like this:

# inputs.conf
[monitor://$SPLUNK_HOME/etc/apps/myapp/tmp]

And/or:

# props.conf
[source::$SPLUNK_HOME/etc/apps/myapp/tmp/*.log]

Is this possible?

It's basically so that an app does not have to be aware of its location on the filesystem, and so that I can run many instances of Splunk with the app installed on a single system without them stepping upon each other.

[gkanapathy]

The former will work (inputs.conf monitor stanza header) but the latter will not (props.conf). However, you shouldn't really need the one in props.conf, as you can certainly just match the end of the filename pattern ([source::.../etc/apps/myapp/tmp/*.log]), or better yet, assign your files a sourcetype in the input and use that to set properties.