Monitoring Splunk

Does splunk support a foo.d/ config directory structure?

kwolf1972
New Member

It'd be handy if Splunk supported a /etc/splunk.d/ configuration structure. This would make it much easier to have puppet or chef drop config files into splunk based on the type of server its being installed on. Does Splunk already support this and I'm just seeing it?

Tags (1)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

I don't know what you mean by a "/etc/splunk.d/"configuration structrure, but all splunk config is contained under $SPLUNK_HOME/etc/system and (more suitable for your use) $SPLUNK_HOME/etc/apps/*. Details of how those are laid out and resolved are in the docs, here and in following sections. You can (and plenty of people do) have puppet or chef place configuration files there. What exactly are you trying to do that this configuration structure doesn't work with, or that is makes harder?

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Just to clarify, the term "apps" is probably misleading. An "app" is nothing more than a configuration bundle, i.e., a set of configuration files, that are merged with all other configuration bundles present on the system.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Then you would do it using $SPLUNK_HOME/etc/apps/*. This has the capabilities equivalent to what you're asking for.

0 Karma

kwolf1972
New Member

Similar to the apache conf.d/ directory where all .conf files inside that directory are parsed. It'd be something similar to $SPLUNK_HOME/etc/system/local/inputs.d/*.conf.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Event Series: Splunk Observability Metrics Cost Optimization

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...