Is there a way to configure Splunk to index its own .conf files or does Splunk already do this?

[landen99]

How can I configure Splunk to index its own conf files? Would there be any issues with doing this?

Or does Splunk already index those files, and if so, then where are they indexed?

[landen99 · Accepted solution]

The solution is within the SOS app to do btools to collect in a saved search:

| btools macros.conf | formatting commands | collect index=myConfIndex

[jzhao_splunk]

If you just want to review the parameter in conf, try this app https://apps.splunk.com/app/2615/

[landen99]

I want to index the data presented by the configuration File Viewer every hour if it changes.

[gfuente]

If you use the SOS app it index the .conf files by default.

[landen99]

I have SOS. Where can I see SOS indexing the conf files?

[gfuente]

The third tab, "Configuration File Viewer"

[landen99]

I see the Configuration File Viewer, but I can't see the search that powers the stanza listing. Where is the information being indexed? ie: index=conf ... I am suspecting that it is not being indexed.

[landen99]

Confirming that the Configuration File Viewer uses btool to pull the data but does not index anything. We have to create searches with btools to send the data to summary indexes ourselves.

[somesoni2]

In my belief, Splunk doesn't index the conf files. If you would like to index the conf files to track the change history on them, you can setup a monitor on different locations where .conf files can be present (etc/system, etc/apps, etc/users).
As far as I know there shouldn't be any issue monitoring .conf files.

[landen99]

Following the guide to indexing windows eventlogs

[landen99]

Added to inputs.conf:

[monitor://C:\Program Files\Splunk\etc\...\*.conf]
sourcetype = conf
index = si_conf
LINE_BREAKER=^\[
followTail = False

...*.conf looks at all subdirectories for any files with conf extensions.
^[ breaks events before each stanza
followTail was just added to get the entire file indexed each time. Haven't verified it yet.