Splunk Search

Adding multiple stanza as list in conf file via setup.conf

Erik_Swan
Splunk Employee
Splunk Employee

For my app i have my own .conf file. The app is the webmonitor app that will on a schedule iterate through a list of urls and time the request, check size, crc contents, etc..

I'd like to reuse the manager or setup.conf system be able to let users add/delete/edit a URL - which is just a stanza in my own conf. Is there a mechanism to hook into manager or via setup.conf let me manage a list of stanza's? I want to reuse the UI for managing file inputs but not manipulate my conf/stanzas.

Thanks in advance! e

Tags (1)

dleung
Splunk Employee
Splunk Employee

I don't think you can hook directly into the manager. However, it sounds like you can try the setup route. After you create setup you can access it via Manager > App and next to your app, there will be setup link.

Have you taken a look at this:
http://www.splunk.com/wiki/Create_a_setup_screen_to_modify_conf_files

It sounds like what you're looking for. You'll need to make a setup.xml for your app. The limitation as mentioned on that page is "The .conf files and stanza(s) you want to modify must already exist."

If you're looking at more flexibility (dynamically create a stanza) take a look here:
http://www.splunk.com/wiki/Create_setup_screen_using_a_custom_endpoint

You will need to write your own endpoint. But you'll have control over specifying the stanza (whether update or create), and key/values that go under that stanza.

Take note:

def handleEdit(self, confInfo):
      ...
      self.writeConf('myappsetup', 'setupentity', self.callerArgs.data)

The parameters to writeConf():
'myappsetup' ==> filename of the .conf you want to write, inputs.conf would be 'inputs'
'setupentity' ==> the stanza name, i.e. 'script://./bin/myScript.sh'
self.callerArgs.data ==> the key/values you want for the stanza.

callerArgs.data is an associative array like so:
{"disabled":0, "interval":60}

It's likely those values won't be static, so you'd need some additional logic to grab those values from setup.xml

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...