includes in inputs.conf

[kochera]

Hi,

we have a static part in our inputs.conf file which is the same on all our systems. What we would like to do now is to include a custom part into inputs.conf. I would rather do it like it is implemented in sudo (multiple includes in the main sudoers) than to have 'dummy' apps for each of the custom inputs.conf

Any ideas?

cheers, Andy

[southeringtonp]

There's no include mechanism as such.

Place your common configuration into an app, and leaving your system-specific entries in the current location. You don't necessarily need a new app for every input - just create a common "shared-inputs" app to contain them, or even put the file in another, existing app. Putting them in search might work well if you aren't using the deployment manager.

I'd do it this way:

Same on all system:        /opt/splunk/etc/apps/shared-inputs/inputs.conf
Machine-level settings:    /opt/splunk/etc/system/local/inputs.conf

(Yes, I know this is still partly what you're trying to avoid, but is probably the cleanest way with current functionality)

[kochera]

Thanks. I'll give it a try although it's not my preferred solution. Would the include mechanism be a future enhancement?

cheers,
andy

[southeringtonp]

I can't speak for Splunk, but it seems like it would be easy to add if enough customers demand it. The best thing would be to submit an enhancement request - see http://answers.splunk.com/questions/4844/how-can-i-submit-an-enhancement-request

[jrodman]

At least one customer has gone the route of constructing conf files eg inputs at splunk-start time. I'm not sure if they wanted includes... I think not, but obviously the goal of doing things your own way exists. Generally we created the bundle system (apps) with the idea of encapsulating logical sets of configuration. The idea of them having a life in the UI, and permissions came much later. You can make apps not have any life in the UI.