Inherit monitor attributes in input stanzas?

[andyk]

Is it OK to do like this:

[monitor://E:\Data\pnlog\createsession\]
soucetype = createsession
recursive = false
host = 10.41.10.13
index = main
disabled = 0
followTail = 1
_TCP_ROUTING = pnlogGroup

[monitor://E:\Data\pnlog\endsession\]
soucetype = endsession

[monitor://E:\Data\pnlog\processing\]
soucetype = processing

Will the attributes from the first monitor stanza be inherited by the other monitor stanzas? or do I have to explicitly set the attributes on all monitor stanzas. I will have about 50 monitor stanzas.

[gkanapathy · Accepted solution]

They are not inherited. You should set each one separately. The only exception is that anything either in a [default] stanza or before any stanza at the beginning of the file will also be inherited by all stanzas. You should be extremely cautious with this latter inheritance, as it occurs even into stanzas that are not in the same file.

[gkanapathy]

As I said, anything under a [default] stanza is inherited by all stanzas in a file.

[leecaf]

There seems to be some form of inheritance under "Configuration layering for modular inputs" as described here

http://docs.splunk.com/Documentation/Splunk/5.0.2/AdvancedDev/ModInputsSpec

However this only applies across different files. Why does splunk not support the inheritance model as described in the original question?

what is the recommended solution when I have 50 monitor stanzas which share mostly the same config but differ by 1 attribute? should I use the "Configuration layering for modular inputs" mechanism and push the child stanza into the application .conf file?

[dwaddle]

You can use Splunk's btool command to see exactly what settings are being pulled into a monitor stanza through default or through other apps.

splunk cmd btool --debug inputs list

http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Usebtooltotroubleshootconfigurati...