Splunk Search

Adding multiple stanza as list in conf file via setup.conf

Splunk Employee
Splunk Employee

For my app i have my own .conf file. The app is the webmonitor app that will on a schedule iterate through a list of urls and time the request, check size, crc contents, etc..

I'd like to reuse the manager or setup.conf system be able to let users add/delete/edit a URL - which is just a stanza in my own conf. Is there a mechanism to hook into manager or via setup.conf let me manage a list of stanza's? I want to reuse the UI for managing file inputs but not manipulate my conf/stanzas.

Thanks in advance! e

Tags (1)

Splunk Employee
Splunk Employee

I don't think you can hook directly into the manager. However, it sounds like you can try the setup route. After you create setup you can access it via Manager > App and next to your app, there will be setup link.

Have you taken a look at this:

It sounds like what you're looking for. You'll need to make a setup.xml for your app. The limitation as mentioned on that page is "The .conf files and stanza(s) you want to modify must already exist."

If you're looking at more flexibility (dynamically create a stanza) take a look here:

You will need to write your own endpoint. But you'll have control over specifying the stanza (whether update or create), and key/values that go under that stanza.

Take note:

def handleEdit(self, confInfo):
      self.writeConf('myappsetup', 'setupentity', self.callerArgs.data)

The parameters to writeConf():
'myappsetup' ==> filename of the .conf you want to write, inputs.conf would be 'inputs'
'setupentity' ==> the stanza name, i.e. 'script://./bin/myScript.sh'
self.callerArgs.data ==> the key/values you want for the stanza.

callerArgs.data is an associative array like so:
{"disabled":0, "interval":60}

It's likely those values won't be static, so you'd need some additional logic to grab those values from setup.xml

0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...