Getting Data In

Modifying modular input's local inputs.conf via the REST API

New Member

Hi all,
I'm trying to change specific values of a modular input's inputs.conf from within the modular input itself. As an example, let's say $SPLUNK_HOME/etc/apps/my_app/local/inputs.conf contains:

key = value
key_alt = value_alt

A GET request (authenticated with a session_key retrieved from STDIN within my modular input) to /services/data/inputs/my_app/TestInput will return the fields along with a ton of extra data, no problem whatsoever. My issues start when I try to modify the fields - say I want to change the key_alt value to alternative. I'm doing via a POST request to the same URI with POST-encoded variables:


So far so good - the server doesn't complain and if I send another GET request to /services/data/inputs/my_app/TestInput the data will reflect the last change. However, instead of actually modifying the value of $SPLUNK_HOME/etc/apps/my_app/local/inputs.conf, Splunk writes the change in $SPLUNK_HOME/etc/apps/search/local/inputs.conf as:

key_alt = alternative

Furthermore (and not too much important), if I am to delete this entry manually, the STDIN configuration for my modular input will still reflect the change forcing me to conclude that there must be some sort of a flush method that I can call to refresh the configuration my modinput receives through STDIN?

But my primary concern is how to force the REST API /services/data/inputs/ endpoint to edit the right inputs.conf (the one it gets the fields from) instead of reaching for the top-level one in /apps/search/local

Any ideas?

0 Karma

New Member

it would seem for modular inputs, the inputs.conf that the stanza is created in depends on the "context" in which you launch Settings | Data Inputs

mod-input inputs.conf stanza created in /etc/apps/launcher/local/inputs.conf
mod-input inputs.conf stanza created in /etc/apps/search/local/inputs.conf
mod-input inputs.conf stanza created in /etc/apps/{app}/local/inputs.conf

Seems strange to me....

I would have expected it to be created at
mod-input inputs.conf stanza created in /etc/apps/{actual-modular-input}/local/inputs.conf

In any event, i have some code that also updates the input.config and it will create the updated configuration in:
mod-input inputs.conf stanza created in /etc/apps/{app}/local/inputs.conf

but will only contain the updated values.

Everything is fine when you use the api / modular input until you try and delete the modular input, and then everything goes haywire and it's not possible to actually delete the input.

i'm using splunk Version:

0 Karma


Try using /servicesNS/<username>/<app path>/data/inputs/ as your endpoint.

I haven't tried this for modular inputs, but it worked for adding an index in the search app's indexes.conf, so I'd be willing to bet it will work here as well.

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...