Getting Data In

Inherit monitor attributes in input stanzas?

andyk
Path Finder

Is it OK to do like this:

[monitor://E:\Data\pnlog\createsession\]
soucetype = createsession
recursive = false
host = 10.41.10.13
index = main
disabled = 0
followTail = 1
_TCP_ROUTING = pnlogGroup

[monitor://E:\Data\pnlog\endsession\]
soucetype = endsession

[monitor://E:\Data\pnlog\processing\]
soucetype = processing

Will the attributes from the first monitor stanza be inherited by the other monitor stanzas? or do I have to explicitly set the attributes on all monitor stanzas. I will have about 50 monitor stanzas.

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

They are not inherited. You should set each one separately. The only exception is that anything either in a [default] stanza or before any stanza at the beginning of the file will also be inherited by all stanzas. You should be extremely cautious with this latter inheritance, as it occurs even into stanzas that are not in the same file.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

They are not inherited. You should set each one separately. The only exception is that anything either in a [default] stanza or before any stanza at the beginning of the file will also be inherited by all stanzas. You should be extremely cautious with this latter inheritance, as it occurs even into stanzas that are not in the same file.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

As I said, anything under a [default] stanza is inherited by all stanzas in a file.

0 Karma

leecaf
Explorer

There seems to be some form of inheritance under "Configuration layering for modular inputs" as described here

http://docs.splunk.com/Documentation/Splunk/5.0.2/AdvancedDev/ModInputsSpec

However this only applies across different files. Why does splunk not support the inheritance model as described in the original question?

what is the recommended solution when I have 50 monitor stanzas which share mostly the same config but differ by 1 attribute? should I use the "Configuration layering for modular inputs" mechanism and push the child stanza into the application .conf file?

0 Karma

dwaddle
SplunkTrust
SplunkTrust

You can use Splunk's btool command to see exactly what settings are being pulled into a monitor stanza through default or through other apps.

splunk cmd btool --debug inputs list

http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Usebtooltotroubleshootconfigurati...

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!