Getting Data In

How to configure multi-value parameters for a Modular Input?

curtisb1024
Path Finder

I'm building a Modular Input and I need to accept an arbitrary number of values for a given parameter. The SDKs seem support this via multi-value parameters (see param_list in this sample input definition):

<stanza name="foobar://bbb">
  <param name="param1">value11</param>
  <param name="param2">value22</param>
  <param name="disabled">0</param>
  <param name="index">default</param>
  <param_list name="multiValue">
    <value>value1</value>
    <value>value2</value>
  </param_list>
  <param_list name="multiValue2">
    <value>value3</value>
    <value>value4</value>
  </param_list>
</stanza>

The problem is, I can't seem to figure out how to configure my stanzas in inputs.conf and input.conf.spec to cause parameters to be passed to my modular input in this format. All of the SDKs seem to support multi-value parameters, but I've not been able to find any documentation on how to actually set the parameters.

In my inputs.conf I've tried:

someParameter = value1;value2

someParameter = value1,value2

someParameter = "value1";"value2"

someParameter = "value1","value2"

someParameter = value1
someParameter = value2

someParameter1 = value1
someParameter2 = value2

But none of these work. How do I pass parameters from inputs.conf to a modular input as a multi-value parameter list (param_list)?

igor
Splunk Employee
Splunk Employee

To way to tell Splunk to split configuration parameters into a list of parameters is via the introspection XML scheme. For example, on Windows, the perfmon input uses this feature:

b:\>%splunk_home%\etc\system\bin\perfmon.cmd --scheme
<scheme>
[...skipped...]
            <arg name="counters">
                <title>counters</title>
                <list_delimiter>;</list_delimiter>
                <required_on_create>false</required_on_create>
            </arg>

The presence of "list_delimiter" tells Splunk that "counters" is a multi-value parameter, and that the delimiter is ";". This will cause the configuration setting to be split by that delimiter.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...

span_metrics: The OpenTelemetry-Idiomatic Way to See Inside Your Services

You open a trace in Splunk Observability Cloud and everything looks fine. One root span, order-pipeline, with ...