Splunk Enterprise

Add a network input using the CLI

SplunkExplorer
Contributor

Hi Splunkers, I'm performing some test on my test environment and I'm curious about observed behavior.

I want to add some network inputs, so tcp and udp ones, to my env.
I found easily on doc how to achieve this: Monitornetworkports and it works fine, with no issues. Inputs are correctly added to my Splunk. I can confirm this with no problem on both web GUI and from CLI using btool.

My wonder is: if I use the command in the above link, inputs are added on inputs.conf located in SPLUNK_HOME\etc\apps\search\local. For example, if I use:

splunk add tcp 3514 -index network -soucetype checkpoint

 

And then, I digit 

splunk btool inputs list --debug | findstr 3514

 

The output is:

C:\Program Files\Splunk\etc\apps\search\local\inputs.conf     [tcp://3514]

 

And, checking manually the file, confs related to my add command are exactly on it.
So, I assume that search is the default app if no additional parameter are provided.
Now, I know well that if I want edit another inputs.conf file, I can simply manually edit it.
But what about if I want edit another inputs.conf from CLI?
In other words: I want to know if I can use the splunk add command and specify which inputs.conf file modify. Is it possible? 

Labels (2)
0 Karma
1 Solution

inventsekar
SplunkTrust
SplunkTrust

Hi @SplunkExplorer 

You are right. Looks like the CLI got no app context parameters. 

the doc link - https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports#Add_a_network_input_usi...

Command Command syntax Action

addadd tcp|udp <port> [-parameter value] ...Add inputs from <port>.
editedit tcp|udp <port> [-parameter value] ...Edit a previously added input for <port>.
removeremove tcp|udp <port>Remove a previously added data input.
listlist tcp|udp [<port>]List the currently configured monitor.

The <port> is the port number on which to listen for data. The user you run the Splunk platform as must have access to this port.

You can modify the configuration of each input by setting any of these optional parameters:

Parameter Description

sourcetypeProvide a sourcetype field value for events from the input source.
indexProvide the destination index for events from the input source.
hostnameProvide a host name to set as the host field value for events from the input source.
remotehostProvide an IP address to exclusively accept data from.
resolvehostSet to true or false (T | F). Default is false. Set to true to use DNS to set the host field value for events from the input source.
restrictToHostProvide a host name or IP address to accept connections only from the specified host or IP address.

 

there is no options to specify the app's context. the CLI and web gui update methods got their limitations. 

the config file editing is the ultimate method which got all of its features and syntax. 

 

Best Regards,

Sekar

View solution in original post

inventsekar
SplunkTrust
SplunkTrust

Hi @SplunkExplorer 

You are right. Looks like the CLI got no app context parameters. 

the doc link - https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports#Add_a_network_input_usi...

Command Command syntax Action

addadd tcp|udp <port> [-parameter value] ...Add inputs from <port>.
editedit tcp|udp <port> [-parameter value] ...Edit a previously added input for <port>.
removeremove tcp|udp <port>Remove a previously added data input.
listlist tcp|udp [<port>]List the currently configured monitor.

The <port> is the port number on which to listen for data. The user you run the Splunk platform as must have access to this port.

You can modify the configuration of each input by setting any of these optional parameters:

Parameter Description

sourcetypeProvide a sourcetype field value for events from the input source.
indexProvide the destination index for events from the input source.
hostnameProvide a host name to set as the host field value for events from the input source.
remotehostProvide an IP address to exclusively accept data from.
resolvehostSet to true or false (T | F). Default is false. Set to true to use DNS to set the host field value for events from the input source.
restrictToHostProvide a host name or IP address to accept connections only from the specified host or IP address.

 

there is no options to specify the app's context. the CLI and web gui update methods got their limitations. 

the config file editing is the ultimate method which got all of its features and syntax. 

 

Best Regards,

Sekar

Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...