Getting Data In

Splunk UF Docker edit props.conf file

eddiemashayev
Path Finder

Hey,

I want to be able to edit this file /opt/splunk/etc/system/default/props.conf and add this data input:
[journald]
KV_MODE = json
MAX_TIMESTAMP_LOOKAHEAD = 10
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TIME_FORMAT = %s
TIME_PREFIX = \"__REALTIME_TIMESTAMP\" : \"
pulldown_type = 1
TZ=UTC

I don't see any way to do it with SPLUNK_CMD
Also didn't find any documentation in https://hub.docker.com/r/splunk/splunk/

Please assist.

Tags (2)
0 Karma

FrankVl
Ultra Champion

Not too familiar with the Docker approach, but in general, you should never, ever edit any config file in etc/system/default/.

Put the additional input configuration into a dedicated app, which you place in etc/apps/.

0 Karma

ddrillic
Ultra Champion

I also wonder which ones of these settings need to be on the indexer side...

0 Karma

FrankVl
Ultra Champion

Oh, didn't even spot that, but this kind of props.conf all goes onto the indexer (unless you use a heavy forwarder). I was a bit blinded by your "I want to ... add this data input". Inputs are usually defined in inputs.conf not props.conf.

0 Karma

eddiemashayev
Path Finder

I'm using Splunk Cloud and when add new source type called journald in the Splunk cloud it's not working unless I'm updating the UF as well with

[journald]
KV_MODE = json
MAX_TIMESTAMP_LOOKAHEAD = 10
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TIME_FORMAT = %s
TIME_PREFIX = \"__REALTIME_TIMESTAMP\" : \"
pulldown_type = 1
TZ=UTC

Is there any option to change it on the Splunk cloud only ?? and it will take effect?

0 Karma

eddiemashayev
Path Finder

Thanks for the answer, still I need to know how do I add this configuration in Docker UF.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...