Splunk Enterprise

configuration files

bucky12
New Member

Explain me construction structure of configuration file in splunk and what all component it contain and what we call them. 

[what are imp configuration files in splunk, what is the purpose of these diffenet files. If a file suppose inputs.conf is present in multiple apps then how splunk will consolidate it. what is the file precedency order. can i have my own configuration file name like my nameinputs.conf file, will it work and how.]

Labels (2)
0 Karma

bucky12
New Member

inputs.conf web.conf. what is the purpose of these files

0 Karma

deepakc
Builder

Inputs.conf

One of the objectives is for you add data into Splunk via a configuration mechanism, typically this is via an inputs.conf file, so if you have logs you want to add to splunk then you would use inputs.conf as a simple example. There are other use case settings as well such as setting the Splunk server's receiver settings as well - see the below link for further examples and use cases.

https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Inputsconf#inputs.conf.example

web.conf

The main object is to configure the Splunk Web settings (HTTP/HTTPS) / security settings - this is set with TLS  certificates for production environment’s  - you can see the examples in the below link

https://docs.splunk.com/Documentation/Splunk/9.2.1/admin/Webconf#web.conf.example

You can  and should create sperate apps, example my_linux_secure_logs and place the inputs.conf there (You can’t change the names of the conf files. 

There is a good app folder diagram here to show you where files and folders live - and you have to follow this structure with the config files you need. 
https://dev.splunk.com/enterprise/docs/developapps/createapps/appanatomy/  

In terms of app precedency, order is based on the lexicographical (alphabetical) order of the app names under global context.

Simple example App A (my_app_a)  will be before App B (my_app_b)

Have a look at the concepts below  on app precedency

https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Wheretofindtheconfigurationfiles  

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This is a broad question. What is your specific usecase that you are trying to solve?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...