Getting Data In

includes in inputs.conf

kochera
Communicator

Hi,

we have a static part in our inputs.conf file which is the same on all our systems. What we would like to do now is to include a custom part into inputs.conf. I would rather do it like it is implemented in sudo (multiple includes in the main sudoers) than to have 'dummy' apps for each of the custom inputs.conf

Any ideas?

cheers, Andy

Tags (1)
0 Karma

southeringtonp
Motivator

There's no include mechanism as such.

Place your common configuration into an app, and leaving your system-specific entries in the current location. You don't necessarily need a new app for every input - just create a common "shared-inputs" app to contain them, or even put the file in another, existing app. Putting them in search might work well if you aren't using the deployment manager.

I'd do it this way:

Same on all system:        /opt/splunk/etc/apps/shared-inputs/inputs.conf
Machine-level settings:    /opt/splunk/etc/system/local/inputs.conf

(Yes, I know this is still partly what you're trying to avoid, but is probably the cleanest way with current functionality)

jrodman
Splunk Employee
Splunk Employee

At least one customer has gone the route of constructing conf files eg inputs at splunk-start time. I'm not sure if they wanted includes... I think not, but obviously the goal of doing things your own way exists. Generally we created the bundle system (apps) with the idea of encapsulating logical sets of configuration. The idea of them having a life in the UI, and permissions came much later. You can make apps not have any life in the UI.

0 Karma

southeringtonp
Motivator

I can't speak for Splunk, but it seems like it would be easy to add if enough customers demand it. The best thing would be to submit an enhancement request - see http://answers.splunk.com/questions/4844/how-can-i-submit-an-enhancement-request

0 Karma

kochera
Communicator

Thanks. I'll give it a try although it's not my preferred solution. Would the include mechanism be a future enhancement?

cheers,
andy

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...