Splunk Search

Environment variable used in search

fresned
Path Finder

How do you set up an Environment variable to be used as part of the path for your data?
I set an environment variable on the system and when I try and use the environment variable I receive an error. The error is :Encountered the following error while trying to save :in handler: machine name: Parameter name : Path must be absolute. The default datasources splunk uses have a set Environment variable as part of there location: $SPLUNK_HOME/etc/splunk.version. Any assistance would be great.

Tags (2)

fresned
Path Finder

Yes where and how is $SPLUNK_HOME defined. I'm trying to define a value $FOO. in the bash shell i have defined export FOO='/opt/test/test1/' I can echo $FOO and get /opt/test/test1/. but splunk returns the error in handler: machine name: Parameter name : Path must be absolute

0 Karma

mw
Splunk Employee
Splunk Employee

Try setting your variable in $SPLUNK_HOME/etc/splunk-launch.conf and restarting. That may do it.

mw
Splunk Employee
Splunk Employee

Do you mean within the context of an input?

# inputs.conf
[monitor://$SPLUNK_HOME/etc/apps/cisco/logs/cisco_firewall.log]
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...