Getting Data In

What is the difference between putting configuration files under the Splunk Search app and other apps?

ankithreddy777
Contributor

May I know the difference between putting configuration files under search-app or any other newly created app/slave-apps in indexers? If we put config files (indexes.conf and props.conf) under search-apps, can we access the index data through other apps?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi ankithreddy777,
access to indexes is related to users roles not to the App in which is inserted the indexes.conf file, so you could configure all conf files in search App, and use them in other Apps.
Every way I suggest to you to insert conf files in the related App for many reason:

  • at first your work order: it's important to clearly identify for every intervene on configurations working in only one App (I usually avoid also to use global objects!);
  • it's important if you need to copy an app in another system (so you can copy only one directory and not a directory + part of some files!);
  • it's useful to maintain Apps: when you create a field or an alias .. all these objects are usually related to sourcetype that usually in defined in props.conf, if you put sourcetype in the search App you have part of your props.conf file in an App (Search) and part of it in another one, and risk to be wrong;
  • maybe you could have only one indexes.conf file, but I don't like. I hope to have been clear. Bye. Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi ankithreddy777,
access to indexes is related to users roles not to the App in which is inserted the indexes.conf file, so you could configure all conf files in search App, and use them in other Apps.
Every way I suggest to you to insert conf files in the related App for many reason:

  • at first your work order: it's important to clearly identify for every intervene on configurations working in only one App (I usually avoid also to use global objects!);
  • it's important if you need to copy an app in another system (so you can copy only one directory and not a directory + part of some files!);
  • it's useful to maintain Apps: when you create a field or an alias .. all these objects are usually related to sourcetype that usually in defined in props.conf, if you put sourcetype in the search App you have part of your props.conf file in an App (Search) and part of it in another one, and risk to be wrong;
  • maybe you could have only one indexes.conf file, but I don't like. I hope to have been clear. Bye. Giuseppe
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...