Splunk Search

Set compression in outputs.conf via CLI

rjszuste
New Member

I'm trying to automate the installation of a Universal Forwarder, the download and installation of the package is ready, the configuration of the forward-server and the inputs is done, but i've found no way to set the compression to true via the CLI.
The command "add forward-server" allows to configure the certificates, but there is no mention about the compression setting.

Tags (1)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

There is no way to do this via CLI, and generally there any many settings that can not be set via CLI commands. (They can be set by config file or via REST API call.)

You should generally automate installations by supplying the desired end-state, rather than trying to specify a procedure. In this case, that means that you should simply put a config file with the appropriate settings you want into your install, rather than running CLI commands to modify the files for you. Splunk's configuration file layering system makes this pretty modular and straightforward.

0 Karma

alexbarnes
Engager

I appreciate there are a lot of possible parameters to cover but it seems like not supporting at least the most important param's (e.g. forwarder will fail to upload data if compressed is not set correctly) makes the dev effort of trying to support any via CLI a little pointless in the long run.

Ah well, thanks for the answer.

0 Karma
Get Updates on the Splunk Community!

Harnessing Splunk’s Federated Search for Amazon S3

Managing your data effectively often means balancing performance, costs, and compliance. Splunk’s Federated ...

Infographic provides the TL;DR for the 2024 Splunk Career Impact Report

We’ve been buzzing with excitement about the recent validation of Splunk Education! The 2024 Splunk Career ...

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...