Getting Data In

splunk-launch.conf declaring variables and variable interpolation

seanwong
Explorer

Hi All,

Has anyone successfully been able to set variables in splunk-launch.conf that you can reference in other configuration files like indexes.conf, inputs.conf, or outputs.conf?

according to http://docs.splunk.com/Documentation/Splunk/latest/Admin/Splunk-launchconf, this is possible but I havent been able to get it working with variables i've set, nor that Splunk has set ($SPLUNK_HOME, $SPLUNK_DB, etc)

I'm trying to define dynamic variables to be used in metadata creation at index time:

fields.conf and inputs.conf like so:
#splunk-launch.conf
baz=some variable
#inputs.conf:
[monitor:///foo]
_meta = bar::$baz
#fields.conf:
[bar]
INDEXED = true

0 Karma

_d_
Splunk Employee
Splunk Employee

.conf files have a special support for consuming environment variables that depends on the variable expansion ability of the code that reads them. That is, some .conf files will honor an environment variable (such as deploymentclient.conf) while others won't (such as inputs.conf).

An alternative way to accomplish what you need (and you most likely are aware of this) is to use transforms.conf at the indexers to create the new field. Yes, you'll incur a performance hit but not likely as much if you're already doing index-time transformations and you key it off of MetaData:Source or MetaData:Host.

lukejadamec
Super Champion

This answer does not appear to be entirely correct. Splunk\etc\system\default\inputs.conf uses the $SPLUNK_HOME environmental variable to monitor Splunk:
[monitor://$SPLUNK_HOME\var\log\splunk]

0 Karma

mikclrk
Explorer

It seems that each .conf file has it's own set of rules for how and where it supports environment variables. Some support them anywhere, some only in certain fields, some simply don't. A little consistency would certainly make things less surprising.

0 Karma

abhishekdharga
Engager

Does $HOSTNAME supported in transforms.conf?
or any one knows the equivalent of that which I can use in transforms.conf?

0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...