Splunk Search

Environment variable used in search

fresned
Path Finder

How do you set up an Environment variable to be used as part of the path for your data?
I set an environment variable on the system and when I try and use the environment variable I receive an error. The error is :Encountered the following error while trying to save :in handler: machine name: Parameter name : Path must be absolute. The default datasources splunk uses have a set Environment variable as part of there location: $SPLUNK_HOME/etc/splunk.version. Any assistance would be great.

Tags (2)

fresned
Path Finder

Yes where and how is $SPLUNK_HOME defined. I'm trying to define a value $FOO. in the bash shell i have defined export FOO='/opt/test/test1/' I can echo $FOO and get /opt/test/test1/. but splunk returns the error in handler: machine name: Parameter name : Path must be absolute

0 Karma

mw
Splunk Employee
Splunk Employee

Try setting your variable in $SPLUNK_HOME/etc/splunk-launch.conf and restarting. That may do it.

mw
Splunk Employee
Splunk Employee

Do you mean within the context of an input?

# inputs.conf
[monitor://$SPLUNK_HOME/etc/apps/cisco/logs/cisco_firewall.log]
0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...