Splunk Enterprise

configuration files

bucky12
New Member

Explain me construction structure of configuration file in splunk and what all component it contain and what we call them. 

[what are imp configuration files in splunk, what is the purpose of these diffenet files. If a file suppose inputs.conf is present in multiple apps then how splunk will consolidate it. what is the file precedency order. can i have my own configuration file name like my nameinputs.conf file, will it work and how.]

Labels (2)
0 Karma

bucky12
New Member

inputs.conf web.conf. what is the purpose of these files

0 Karma

deepakc
Builder

Inputs.conf

One of the objectives is for you add data into Splunk via a configuration mechanism, typically this is via an inputs.conf file, so if you have logs you want to add to splunk then you would use inputs.conf as a simple example. There are other use case settings as well such as setting the Splunk server's receiver settings as well - see the below link for further examples and use cases.

https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Inputsconf#inputs.conf.example

web.conf

The main object is to configure the Splunk Web settings (HTTP/HTTPS) / security settings - this is set with TLS  certificates for production environment’s  - you can see the examples in the below link

https://docs.splunk.com/Documentation/Splunk/9.2.1/admin/Webconf#web.conf.example

You can  and should create sperate apps, example my_linux_secure_logs and place the inputs.conf there (You can’t change the names of the conf files. 

There is a good app folder diagram here to show you where files and folders live - and you have to follow this structure with the config files you need. 
https://dev.splunk.com/enterprise/docs/developapps/createapps/appanatomy/  

In terms of app precedency, order is based on the lexicographical (alphabetical) order of the app names under global context.

Simple example App A (my_app_a)  will be before App B (my_app_b)

Have a look at the concepts below  on app precedency

https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Wheretofindtheconfigurationfiles  

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This is a broad question. What is your specific usecase that you are trying to solve?

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...