How to Read a dynamic host name from file and apply it to inputs.conf?

[Eminemvin]

Is there a way to dynamically set the host name to read from a file? For example, instead of using the [default] host =xxxxx from inputs.conf, I'd like to get it from a config file:

/some/directory/foo.conf
that contains a host of:
ID = foo001

I've seen resources of setting host name based on regex of filenames but that's not exactly what i need. I need to read the host name from within the file.I'm thinking of possible alternatives but if this is already existing it would help a lot. Thanks.

[skoelpin]

I would agree with @rich7177 that there is no native Splunk way to do this (There could be but I've never heard of it)

Since your on a Linux server, this should be somewhat straight forward to do with some scripting

I would first start by going into etc/init.d and create a script which will start on boot. The script should then look like this

#!/bin/bash
cd /some/directory/foo.conf
# Cat foo.conf and run a regular expression against it and extract the hostname and save it as a variable below 
host="hostname"
cd /opt/splunk/bin
./splunk stop
cd /opt/splnuk/etc/system/local
mv inputs.conf inputsOLD.conf
touch inputs.conf
#Use sed to display your $host and fill in the rest of your inputs.conf stanza 
cd /opt/splunk/bin
./splunk start 

This is untested, but I've done a lot of automation in my day so I'm fairly confident this will dynamically modify your inputs.conf correctly

[Richfez]

I'm not aware of setting this in exactly the manner you describe. That doesn't mean there's no solution at all, though.

Assuming you aren't trying to change it willy-nilly all over the place and just need it set a certain way at first start (or "occasionally"), why can't you script building a new inputs.conf file when you need it then trigger a splunk restart?

In Unix/Linux you have built in tools (sed, perl, sh) that can likely change the hostname in place. I'm not hip on the deployment methods available in the land of Torvalds to know how this would be deployed - all my Nix Splunk boxes are manually installed - but I'm sure it could be done as part of the initial install via a wrapper or something. Install but leave service off, back up the inputs.conf file, run your bits to read the hostname you want and sed/whatever your value into the hostname (or whatever other settings you want) then start the service up. Tada!

For completeness, though your pathing indicates you are probably asking about Linux: In Windows you can take bits and pieces of files and smash 'em all together after adding your bits in the middle. Simplest way could be in your .cmd file do something like

copy c:\bleh2\header.txt+c:\bleh2\conf.txt+c:\bleh2\footer.txt c:\mysplunkpath\inputs.conf

In this I know for a fact there are options for automatically deploying it - you can deploy the batch file as part of an SCCM app, by logon script, GPO, etc... One of those would surely work to get it out there and in place.

As always listen to the voice of experience and TEST WELL. 🙂 Oh, and check my copy syntax, I'm sure I'm munged it up entirely.