Splunk Dev

Splunk Add-on Builder: Custom inputs.conf configuration option

MichaelMcAleer
Path Finder

Hi Splunk Community,

I am building a Python modular input using the Splunk add-on builder tool and I want to add a custom configuration option 'performance_custom_metrics' which is optional and set only in inputs.conf, not via the data input UI configuration defined when building the add-on.

Everything seems fine for the most part, but when I try to add a new data input I get the following error about the optional config option:

The following required arguments are missing: performance_custom_metrics

 Because performance_custom_metrics is not defined in the add-on UI configuration I am not allowed to create inputs via the UI. Only manual creation via inputs.conf works as expected.

I've set required_on_create and required_on_edit both to False when defining the argument in inputs.py:

scheme.add_argument(smi.Argument(
'performance_custom_metrics', required_on_create=False,
required_on_edit=False))

From solnlib/packages/splunklib/modularinput/argument.py #60:

:param required_on_edit: ``Boolean``, whether this arg is required when editing an existing modular input of this kind.
:param required_on_create: ``Boolean``, whether this arg is required when creating a modular input of this kind.

Has anyone any idea what other option I need to set to make performance_custom_metrics an optional input parameter for my add-on?

Labels (3)
Tags (3)
0 Karma

chli_splunk
Splunk Employee
Splunk Employee

When you add a parameter thru UI, AoB will do following things for you:

  1. Add the parameter definition in /README/inputs.conf.spec
  2. Add the default value in /default/inputs.conf
  3. Add the parameter in custom REST endpoint to operate this value thru Splunk REST API
  4. Update Addon UI
  5. Update AoB internal metadata

If we want to add one parameter without AoB, please follow Splunk doc to create modular input manually. If we still want to use AoB to read/write this parameter in Python code, please do #1,2,3 manually. But basically this hack approach is not officially supported by AoB. We can try it but not guaranteed it's gonna work.

Personal speaking, add this optional parameter via AoB UI with a default value is not harmful. If you really want to hide it from Addon UI, you can try to add it first, and then update Addon frontend code to remove it. That could be an easier approach.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...