Splunk for configuration Management

[socteam]

Hi Guys,

Can we use Splunk for configuration management? I know that splunk can be used for integrity checking of files, we want to use this for configuration files (Linux systems, routers, switches...etc)? If we use integrity checking, does it backup the config files?with different versions? can we retrieve them?

[kristian_kolb]

In theory you could do that, but it probably not be the simplest solution.

If you read the documentation for inputs.conf, the fschange section

fullEvent = [true|false]
* Set to true to send the full event if an add or update change is detected. 
* Further qualified by the sendEventMaxSize attribute. 
* Defaults to false.

Unfortunately, my experience with this is somewhat mixed, since if I remember correctly, Linux forwarders will send the whole file in one event, and Windows forwarders will send each line of the file as a separate event.

Hope this helps,

/Kristian