Getting Data In
Highlighted

Can props.conf and indexes.conf be split for more clear structure?

Path Finder

Hi,
as mentioned in the title I'm wondering, if the props.conf or indexes.conf can be split for a more clear structure. Does anybody do this?
Best regards,
Yannic

Tags (2)
0 Karma
Highlighted

Re: Can props.conf and indexes.conf be split for more clear structure?

Champion

Since you can't have more than one file with the name props.conf in the same folder, you can't directly split them. Also, using system/local and apps/search/local might help you but it could also have implications regarding the application of the settings (due to different configuration file precedence).

You can however arrange and separate the contents of your files with comments, much like the files in the default folder do:

# # # # # # # # # # # # # # #
# This section is for foo.  #
# # # # # # # # # # # # # # #

[stanza]
setting = foo

[stanza]
setting = bar

# # # # # # # # # # # # # # #
# This section is for bar.  #
# # # # # # # # # # # # # # #

[stanza]
setting = baz

You can also keep emtpy lines to help with the visibility.

0 Karma
Highlighted

Re: Can props.conf and indexes.conf be split for more clear structure?

SplunkTrust
SplunkTrust

Do you mean have 2 separate props.conf files? If so then no. Why don't you just keep it in one file and seperate your stanza by comments with stars in them like this?

#************************
#
#
#  Edited by: 
#  Modified index 
#  8/6/2015
#
#
#*************************

[host:: srv-dcr01]
.........
.........
........

0 Karma
Highlighted

Re: Can props.conf and indexes.conf be split for more clear structure?

Communicator

In a larger deployment it is best practice to create custom TA apps to use as containers for configurations that are logically grouped together. Monolithic configuration in $SPLUNK_HOME/system/local becomes unmaintainable, should be avoided.

Your configurations should be deployed to $SPLUNK_HOME/etc/apps, similar to this:

└── apps
    ├── TA-thing1
    │   ├── local
    │   │   ├── app.conf
    │   │   ├── indexes.conf
    │   │   ├── props.conf
    │   │   └── transforms.conf
    │   └── metadata
    │       └── local.meta
    └── TA-thing2
        ├── local
        │   ├── app.conf
        │   ├── indexes.conf
        │   └── props.conf
        └── metadata
            └── local.meta

Check out this Wiki article for some info on building a simple config app: http://wiki.splunk.com/Community:Creating_your_first_application

0 Karma
Highlighted

Re: Can props.conf and indexes.conf be split for more clear structure?

Esteemed Legend

Yes, you should not be using/putting these files inside of $SPLUNK_HOME/etc/system/local/ which has global scope. Instead you should be creating your own app, something like $SPLUNK_HOME/etc/system/apps/myApp/default/ and creating your input/sourcetype/app-specific configurations inside configuration files that are put there.

0 Karma