Getting Data In

Practices when reading/writing .conf files

Path Finder


In the Splunk App I am working on , there is a need to specify some parameters through UI, persist them and later on read/update them. Since the "setup screen" doesn't provide me all the flexibility I need I've looked for other options. Eventually I realized that by using a custom controller and reading/writing some .conf files I can obtain what I need. However the tricky part is manipulating those files. Reading content created no problems , with the following code

      import splunk.bundle as bundle

       dict = {}
            conf = bundle.getConf(self.MY_CONF_FILE)
            for stanza in conf:
      "stanza : "+stanza )
                dict[stanza] = {}
        except splunk.ResourceNotFound:

Writing on the other hand , done though the Splunk bundle proved to offer something else then desired. The content was written in a version of MY_CONF_FILE located somewhere else then ".../myApp/default" directory (perhaps "..../system/local", it's a while since I've tried it). So In my intention to persist some configuration I realized that I was reading from a file and writing to another file, therefore subsequent reads would not bring previous writes.

Here's the code used to write

 conf = bundle.getConf(self.MY_CONF_FILE)
    conf['STANZA']['setting_1'] = value_1
    conf['STANZA']['setting_2'] = value_2
    conf['STANZA']['setting_3'] = value_3

Therefore I resorted to use ConfigParser for reading/writing .conf files , without doing it through Splunk.

def writeMacrosConfFile(self,statisticsPort):
   writeSuccesfull = True       
        parser = ConfigParser.SafeConfigParser()
        parser.set(MACRO_PORT_STANZA, DEFINITION, statisticsPort)   
        with open(MACROS_CONF_FILE, 'wb') as configfile:
    except Exception as e:
        writeSuccesfull = False  

This is done for both custom .conf files and the macros.conf file

The question would be if there is something wrong in manipulating the .conf files like this since I am feeling it is not according to the Splunk way ? Would this kind of code render the Splunk app unacceptable for uploading in Splunkbase ?

Also any feedback on reading/writing .conf files would be greatly welcomed.

0 Karma


You may also want to check out the new KV store feature. We are using this for config state in the latest versions of ES, Windows Infrastructure, and other apps in the future.

0 Karma

Path Finder


You may think of preserving the case if the config that you are working with is also touched by splunk, such as server.conf or web.conf and so on(parser_obj.optionxform = str). Otherwise my experience is that it is fine to use python's ConfigParser.


0 Karma

Path Finder

I submitted the app including the custom/system conf files manipulation using ConfigParser and the result is that it got accepted. So I guess this is acceptable. Hope it will help the next person having the same dilema as I did.


0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>