Getting Data In

splunk-launch.conf declaring variables and variable interpolation

seanwong
Explorer

Hi All,

Has anyone successfully been able to set variables in splunk-launch.conf that you can reference in other configuration files like indexes.conf, inputs.conf, or outputs.conf?

according to http://docs.splunk.com/Documentation/Splunk/latest/Admin/Splunk-launchconf, this is possible but I havent been able to get it working with variables i've set, nor that Splunk has set ($SPLUNK_HOME, $SPLUNK_DB, etc)

I'm trying to define dynamic variables to be used in metadata creation at index time:

fields.conf and inputs.conf like so:
#splunk-launch.conf
baz=some variable
#inputs.conf:
[monitor:///foo]
_meta = bar::$baz
#fields.conf:
[bar]
INDEXED = true

0 Karma

_d_
Splunk Employee
Splunk Employee

.conf files have a special support for consuming environment variables that depends on the variable expansion ability of the code that reads them. That is, some .conf files will honor an environment variable (such as deploymentclient.conf) while others won't (such as inputs.conf).

An alternative way to accomplish what you need (and you most likely are aware of this) is to use transforms.conf at the indexers to create the new field. Yes, you'll incur a performance hit but not likely as much if you're already doing index-time transformations and you key it off of MetaData:Source or MetaData:Host.

lukejadamec
Super Champion

This answer does not appear to be entirely correct. Splunk\etc\system\default\inputs.conf uses the $SPLUNK_HOME environmental variable to monitor Splunk:
[monitor://$SPLUNK_HOME\var\log\splunk]

0 Karma

mikclrk
Explorer

It seems that each .conf file has it's own set of rules for how and where it supports environment variables. Some support them anywhere, some only in certain fields, some simply don't. A little consistency would certainly make things less surprising.

0 Karma

abhishekdharga
Engager

Does $HOSTNAME supported in transforms.conf?
or any one knows the equivalent of that which I can use in transforms.conf?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...