Getting Data In

Can props.conf and indexes.conf be split for more clear structure?

yAlff
Path Finder

Hi,
as mentioned in the title I'm wondering, if the props.conf or indexes.conf can be split for a more clear structure. Does anybody do this?
Best regards,
Yannic

Tags (2)
0 Karma

woodcock
Esteemed Legend

Yes, you should not be using/putting these files inside of $SPLUNK_HOME/etc/system/local/ which has global scope. Instead you should be creating your own app, something like $SPLUNK_HOME/etc/system/apps/myApp/default/ and creating your input/sourcetype/app-specific configurations inside configuration files that are put there.

0 Karma

jacobwilkins
Communicator

In a larger deployment it is best practice to create custom TA apps to use as containers for configurations that are logically grouped together. Monolithic configuration in $SPLUNK_HOME/system/local becomes unmaintainable, should be avoided.

Your configurations should be deployed to $SPLUNK_HOME/etc/apps, similar to this:

└── apps
    ├── TA-thing1
    │   ├── local
    │   │   ├── app.conf
    │   │   ├── indexes.conf
    │   │   ├── props.conf
    │   │   └── transforms.conf
    │   └── metadata
    │       └── local.meta
    └── TA-thing2
        ├── local
        │   ├── app.conf
        │   ├── indexes.conf
        │   └── props.conf
        └── metadata
            └── local.meta

Check out this Wiki article for some info on building a simple config app: http://wiki.splunk.com/Community:Creating_your_first_application

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Do you mean have 2 separate props.conf files? If so then no. Why don't you just keep it in one file and seperate your stanza by comments with stars in them like this?

#************************
#
#
#  Edited by: 
#  Modified index 
#  8/6/2015
#
#
#*************************

[host:: srv-dcr01]
.........
.........
........

0 Karma

jeffland
Champion

Since you can't have more than one file with the name props.conf in the same folder, you can't directly split them. Also, using system/local and apps/search/local might help you but it could also have implications regarding the application of the settings (due to different configuration file precedence).

You can however arrange and separate the contents of your files with comments, much like the files in the default folder do:

# # # # # # # # # # # # # # #
# This section is for foo.  #
# # # # # # # # # # # # # # #

[stanza]
setting = foo

[stanza]
setting = bar

# # # # # # # # # # # # # # #
# This section is for bar.  #
# # # # # # # # # # # # # # #

[stanza]
setting = baz

You can also keep emtpy lines to help with the visibility.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...