splunk-launch.conf declaring variables and variable interpolation

[seanwong]

Hi All,

Has anyone successfully been able to set variables in splunk-launch.conf that you can reference in other configuration files like indexes.conf, inputs.conf, or outputs.conf?

according to http://docs.splunk.com/Documentation/Splunk/latest/Admin/Splunk-launchconf, this is possible but I havent been able to get it working with variables i've set, nor that Splunk has set ($SPLUNK_HOME, $SPLUNK_DB, etc)

I'm trying to define dynamic variables to be used in metadata creation at index time:

fields.conf and inputs.conf like so:
#splunk-launch.conf
baz=some variable
#inputs.conf:
[monitor:///foo]
_meta = bar::$baz
#fields.conf:
[bar]
INDEXED = true

[_d_]

.conf files have a special support for consuming environment variables that depends on the variable expansion ability of the code that reads them. That is, some .conf files will honor an environment variable (such as deploymentclient.conf) while others won't (such as inputs.conf).

An alternative way to accomplish what you need (and you most likely are aware of this) is to use transforms.conf at the indexers to create the new field. Yes, you'll incur a performance hit but not likely as much if you're already doing index-time transformations and you key it off of MetaData:Source or MetaData:Host.

[lukejadamec]

This answer does not appear to be entirely correct. Splunk\etc\system\default\inputs.conf uses the $SPLUNK_HOME environmental variable to monitor Splunk:
[monitor://$SPLUNK_HOME\var\log\splunk]

[mikclrk]

It seems that each .conf file has it's own set of rules for how and where it supports environment variables. Some support them anywhere, some only in certain fields, some simply don't. A little consistency would certainly make things less surprising.

[abhishekdharga]

Does $HOSTNAME supported in transforms.conf?
or any one knows the equivalent of that which I can use in transforms.conf?