dynamically create input.conf with multiple inputs

[nileshbairagi]

Hello,

I am a splunk user and need help/ suggestion to use splunk in specific scenario.
I need to use splunk in multi-server servers environment, where server configurations are dynamic and scripted.
For each server there are multiple inputs for logs in inputs.conf (like app, system, backend server etc.)

Is there a way to drop multiple conf files like nginx in conf.d and then include them?
OR each server config script will edit the single input.conf and add its own input.

This is because i want to generate input.conf dynamically based on server configuration.
Any help/ suggestions will be helpful.

Thank you.

[gkanapathy]

I think what you want is exactly what is handled by the standard Splunk configuration system, since multiple inputs.conf files are merged if they are in multiple folders. Please read the documenation on configuration files to see how to arrange the files, as well as rules on conflict resolution.

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles

[Damien_Dallimor]

You can dynamically create, update and remove inputs(file, tcp, udp etc..) via the Splunk REST API.

And we have several language SDKs to make it easier to program to the REST API