Getting Data In

Can props.conf and indexes.conf be split for more clear structure?

yAlff
Path Finder

Hi,
as mentioned in the title I'm wondering, if the props.conf or indexes.conf can be split for a more clear structure. Does anybody do this?
Best regards,
Yannic

Tags (2)
0 Karma

woodcock
Esteemed Legend

Yes, you should not be using/putting these files inside of $SPLUNK_HOME/etc/system/local/ which has global scope. Instead you should be creating your own app, something like $SPLUNK_HOME/etc/system/apps/myApp/default/ and creating your input/sourcetype/app-specific configurations inside configuration files that are put there.

0 Karma

jacobwilkins
Communicator

In a larger deployment it is best practice to create custom TA apps to use as containers for configurations that are logically grouped together. Monolithic configuration in $SPLUNK_HOME/system/local becomes unmaintainable, should be avoided.

Your configurations should be deployed to $SPLUNK_HOME/etc/apps, similar to this:

└── apps
    ├── TA-thing1
    │   ├── local
    │   │   ├── app.conf
    │   │   ├── indexes.conf
    │   │   ├── props.conf
    │   │   └── transforms.conf
    │   └── metadata
    │       └── local.meta
    └── TA-thing2
        ├── local
        │   ├── app.conf
        │   ├── indexes.conf
        │   └── props.conf
        └── metadata
            └── local.meta

Check out this Wiki article for some info on building a simple config app: http://wiki.splunk.com/Community:Creating_your_first_application

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Do you mean have 2 separate props.conf files? If so then no. Why don't you just keep it in one file and seperate your stanza by comments with stars in them like this?

#************************
#
#
#  Edited by: 
#  Modified index 
#  8/6/2015
#
#
#*************************

[host:: srv-dcr01]
.........
.........
........

0 Karma

jeffland
SplunkTrust
SplunkTrust

Since you can't have more than one file with the name props.conf in the same folder, you can't directly split them. Also, using system/local and apps/search/local might help you but it could also have implications regarding the application of the settings (due to different configuration file precedence).

You can however arrange and separate the contents of your files with comments, much like the files in the default folder do:

# # # # # # # # # # # # # # #
# This section is for foo.  #
# # # # # # # # # # # # # # #

[stanza]
setting = foo

[stanza]
setting = bar

# # # # # # # # # # # # # # #
# This section is for bar.  #
# # # # # # # # # # # # # # #

[stanza]
setting = baz

You can also keep emtpy lines to help with the visibility.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...