Getting Data In

dynamically create input.conf with multiple inputs

New Member


I am a splunk user and need help/ suggestion to use splunk in specific scenario.
I need to use splunk in multi-server servers environment, where server configurations are dynamic and scripted.
For each server there are multiple inputs for logs in inputs.conf (like app, system, backend server etc.)

Is there a way to drop multiple conf files like nginx in conf.d and then include them?
OR each server config script will edit the single input.conf and add its own input.

This is because i want to generate input.conf dynamically based on server configuration.
Any help/ suggestions will be helpful.

Thank you.

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

I think what you want is exactly what is handled by the standard Splunk configuration system, since multiple inputs.conf files are merged if they are in multiple folders. Please read the documenation on configuration files to see how to arrange the files, as well as rules on conflict resolution.

0 Karma

Ultra Champion

You can dynamically create, update and remove inputs(file, tcp, udp etc..) via the Splunk REST API.

And we have several language SDKs to make it easier to program to the REST API

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!