I am in the process of moving my indexer to a new server, and in the process, I thought it would be a good idea to combine the multiple configuration files that were scattered through $SPLUNK_HOME. The files I condensed are indexes.conf, transforms.conf, props.conf, serverclasses.conf (did not stick all of it in 1 file, the serverclasses.conf files went to a serverclasses.conf file).
I put the new configuration files in $SPLUNK_HOME/etc/system/custom_configs
(so they were not higher than etc/local files). However when I rebooted and ran btool none of my configurations were imported. Thinking I had read the guide on the configurations incorrectly, also tried $SPLUNK_HOME/etc/system/local/custom_configs
and $SPLUNK_HOME/etc/apps/custom_configs
, but neither local corrected the issue.
I checked the permissions and even set the owner as splunk.
I am at a loss as to what I am doing wrong.
My environment is pretty simple:
Version: 6.3.3
No. Indexers: 1
Roles for indexer: all
Thanks,
Sean
Hi seanbarbour,
I'm not aware that you could place .conf
files in other directories then:
Looking at your path $SPLUNK_HOME/etc/system/custom_configs
I reckon this is simply ignored by Splunk and therefore not loaded.
The above list does not include any clustered apps folder; see the docs for a complete overview http://docs.splunk.com/Documentation/Splunk/6.4.0/Admin/Wheretofindtheconfigurationfiles
Hope this helps ...
cheers, MuS
Hi seanbarbour,
I'm not aware that you could place .conf
files in other directories then:
Looking at your path $SPLUNK_HOME/etc/system/custom_configs
I reckon this is simply ignored by Splunk and therefore not loaded.
The above list does not include any clustered apps folder; see the docs for a complete overview http://docs.splunk.com/Documentation/Splunk/6.4.0/Admin/Wheretofindtheconfigurationfiles
Hope this helps ...
cheers, MuS
I will move them outside of the custom_configs directory and see what happens.
Yea, so I am feeling a little dumb. They can be in any of the directories standard directories, but they need to be in a local folder. creating custom_configs/local and moving the files seems to work. I am getting errors on my configuration files so i will count that as progress.
Thanks!
Sean
Please accept the answer if it answers your question - thanks 🙂
Might help if I posted the output of the stanza from btool:
[root@ ~]# cd /opt/splunk/bin/
[root@ bin]# ./splunk cmd btool server list --debug | grep '\['
/opt/splunk/etc/system/default/server.conf [applicationsManagement]
/opt/splunk/etc/system/default/server.conf [clustering]
/opt/splunk/etc/system/default/server.conf [diag]
/opt/splunk/etc/system/default/server.conf [diskUsage]
/opt/splunk/etc/system/default/server.conf [fileInput]
/opt/splunk/etc/system/local/server.conf [general]
/opt/splunk/etc/system/default/server.conf [httpServer]
/opt/splunk/etc/apps/introspection_generator_addon/default/server.conf [introspection:generator:disk_objects]
/opt/splunk/etc/system/default/server.conf [introspection:generator:disk_objects__bundle_replication]
/opt/splunk/etc/system/default/server.conf [introspection:generator:disk_objects__fishbucket]
/opt/splunk/etc/apps/introspection_generator_addon/default/server.conf [introspection:generator:kvstore]
/opt/splunk/etc/apps/introspection_generator_addon/default/server.conf [introspection:generator:resource_usage]
/opt/splunk/etc/system/default/server.conf [kvstore]
/opt/splunk/etc/system/local/server.conf [license]
/opt/splunk/etc/system/local/server.conf [lmpool:auto_generated_pool_download-trial]
/opt/splunk/etc/system/local/server.conf [lmpool:auto_generated_pool_enterprise]
/opt/splunk/etc/system/local/server.conf [lmpool:auto_generated_pool_forwarder]
/opt/splunk/etc/system/local/server.conf [lmpool:auto_generated_pool_free]
/opt/splunk/etc/system/default/server.conf [mimetype-extension-map]
/opt/splunk/etc/system/default/server.conf [pooling]
/opt/splunk/etc/system/default/server.conf [queue]
/opt/splunk/etc/system/default/server.conf [queue=AQ]
/opt/splunk/etc/system/default/server.conf [queue=WEVT]
/opt/splunk/etc/system/default/server.conf [queue=aggQueue]
/opt/splunk/etc/system/default/server.conf [queue=fschangemanager_queue]
/opt/splunk/etc/system/default/server.conf [queue=parsingQueue]
/opt/splunk/etc/system/default/server.conf [queue=vixQueue]
/opt/splunk/etc/apps/SA-ldapsearch/default/server.conf [shclustering]
/opt/splunk/etc/system/local/server.conf [sslConfig]
[root@ bin]#