- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Is there a way to configure Splunk to index its ow...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How can I configure Splunk to index its own conf files? Would there be any issues with doing this?
Or does Splunk already index those files, and if so, then where are they indexed?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The solution is within the SOS app to do btools to collect in a saved search:
| btools macros.conf | formatting commands | collect index=myConfIndex
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The solution is within the SOS app to do btools to collect in a saved search:
| btools macros.conf | formatting commands | collect index=myConfIndex
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you just want to review the parameter in conf, try this app https://apps.splunk.com/app/2615/
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I want to index the data presented by the configuration File Viewer every hour if it changes.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you use the SOS app it index the .conf files by default.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have SOS. Where can I see SOS indexing the conf files?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The third tab, "Configuration File Viewer"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I see the Configuration File Viewer, but I can't see the search that powers the stanza listing. Where is the information being indexed? ie: index=conf ... I am suspecting that it is not being indexed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Confirming that the Configuration File Viewer uses btool to pull the data but does not index anything. We have to create searches with btools to send the data to summary indexes ourselves.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In my belief, Splunk doesn't index the conf files. If you would like to index the conf files to track the change history on them, you can setup a monitor on different locations where .conf files can be present (etc/system, etc/apps, etc/users).
As far as I know there shouldn't be any issue monitoring .conf files.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Following the guide to indexing windows eventlogs
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Added to inputs.conf:
[monitor://C:\Program Files\Splunk\etc\...\*.conf]
sourcetype = conf
index = si_conf
LINE_BREAKER=^\[
followTail = False
...*.conf looks at all subdirectories for any files with conf extensions.
^[ breaks events before each stanza
followTail was just added to get the entire file indexed each time. Haven't verified it yet.
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
