Splunk Search

Adding multiple stanza as list in conf file via setup.conf

Erik_Swan
Splunk Employee
Splunk Employee

For my app i have my own .conf file. The app is the webmonitor app that will on a schedule iterate through a list of urls and time the request, check size, crc contents, etc..

I'd like to reuse the manager or setup.conf system be able to let users add/delete/edit a URL - which is just a stanza in my own conf. Is there a mechanism to hook into manager or via setup.conf let me manage a list of stanza's? I want to reuse the UI for managing file inputs but not manipulate my conf/stanzas.

Thanks in advance! e

Tags (1)

dleung
Splunk Employee
Splunk Employee

I don't think you can hook directly into the manager. However, it sounds like you can try the setup route. After you create setup you can access it via Manager > App and next to your app, there will be setup link.

Have you taken a look at this:
http://www.splunk.com/wiki/Create_a_setup_screen_to_modify_conf_files

It sounds like what you're looking for. You'll need to make a setup.xml for your app. The limitation as mentioned on that page is "The .conf files and stanza(s) you want to modify must already exist."

If you're looking at more flexibility (dynamically create a stanza) take a look here:
http://www.splunk.com/wiki/Create_setup_screen_using_a_custom_endpoint

You will need to write your own endpoint. But you'll have control over specifying the stanza (whether update or create), and key/values that go under that stanza.

Take note:

def handleEdit(self, confInfo):
      ...
      self.writeConf('myappsetup', 'setupentity', self.callerArgs.data)

The parameters to writeConf():
'myappsetup' ==> filename of the .conf you want to write, inputs.conf would be 'inputs'
'setupentity' ==> the stanza name, i.e. 'script://./bin/myScript.sh'
self.callerArgs.data ==> the key/values you want for the stanza.

callerArgs.data is an associative array like so:
{"disabled":0, "interval":60}

It's likely those values won't be static, so you'd need some additional logic to grab those values from setup.xml

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...