Knowledge Management

Multiple conf files with single endpoint or referencing other conf files?


I have an app with setup.xml where a hostname is entered. I've also made a custom conf file and setup the REST endpoint for it. A python script uses this info. This all works great.

However, I need workflow_actions.conf to also know about that hostname in the URL of an action (link.uri).

What's the best way to go about this in splunk?

0 Karma


There is no way to get a configuration file to reference another configuration file, at least not in the way you describe.
However, Splunk has a way to store "state information" like a hostname. There are two variations.

First, you could write the information to a csv file stored in the lookups subdirectory, and set up the csv file as a lookup.
Or, you could write the information (as a collection) to the KV store and set up a lookup based on the collection.

Here is some documentation that may help:

Tutorial: Use KV Store with a simple app

Administer the app key value store

Use field lookups

0 Karma