All Apps and Add-ons

What is the difference between App Search and App Launcher?

brettski
Explorer

I am looking through my list of Data inputs (files) and notice some have an app of Search, while others have an app of launcher. What is the difference between these two apps and does it really matter which one is being used?

Tags (1)
1 Solution

sideview
SplunkTrust
SplunkTrust

It's very easy to accidentally save things into Launcher app when you probably intended to save them into the Search app. In the particular case of data inputs though, it doesn't really matter because inputs take effect at the system level anyway.

However if some inputs ended up in Launcher, you may find that you've saved some other entities like saved searches into the Launcher app by mistake. If so it's good to clean these mistakes up sooner rather than later before they cause confusion.

In short, Every configuration change in splunk maps to some key(s) in some stanza in some configuration file. However the files are interpreted in a layered fashion and this is where things get complicated. See here for more details:: http://www.splunk.com/base/Documentation/latest/Admin/Wheretofindtheconfigurationfiles

This means that a particular data input, or an eventtype or a regex or whatever, might be in the system directories, or it might be in an app context, meaning it's in the directories within that app. Beyond that granularity, for some entities like 'viewstates' and 'savedsearches', it can even be over in a user layer, within an app layer, like /etc/users///savedsearches.conf.

And on the other extreme like for inputs.conf and many keys in props.conf (possibly all im not sure), the app context doesn't actually affect it's functionality at all; the changes take effect at a system level even if the file happens to be inside some app directory...

I hope this helps.

View solution in original post

mpelini
New Member

If you add an input, Splunk adds that input to a copy of inputs.conf that belongs to the app you're in when you add that input. This means that if you navigated to Splunk Manager, directly from the Launcher your input will be added to $SPLUNK_HOME/etc/apps/launcher/local/inputs.conf.

http://docs.splunk.com/Documentation/Splunk/latest/User/AddDataToYourIndexes

0 Karma

sideview
SplunkTrust
SplunkTrust

It's very easy to accidentally save things into Launcher app when you probably intended to save them into the Search app. In the particular case of data inputs though, it doesn't really matter because inputs take effect at the system level anyway.

However if some inputs ended up in Launcher, you may find that you've saved some other entities like saved searches into the Launcher app by mistake. If so it's good to clean these mistakes up sooner rather than later before they cause confusion.

In short, Every configuration change in splunk maps to some key(s) in some stanza in some configuration file. However the files are interpreted in a layered fashion and this is where things get complicated. See here for more details:: http://www.splunk.com/base/Documentation/latest/Admin/Wheretofindtheconfigurationfiles

This means that a particular data input, or an eventtype or a regex or whatever, might be in the system directories, or it might be in an app context, meaning it's in the directories within that app. Beyond that granularity, for some entities like 'viewstates' and 'savedsearches', it can even be over in a user layer, within an app layer, like /etc/users///savedsearches.conf.

And on the other extreme like for inputs.conf and many keys in props.conf (possibly all im not sure), the app context doesn't actually affect it's functionality at all; the changes take effect at a system level even if the file happens to be inside some app directory...

I hope this helps.

brettski
Explorer

It's about as clear as the rest of the Splunk documentation. 😛 So my assumption is remake those inputs using search and only have them follow the file tail to avoid duplicating data.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...