Hi all,
I'm trying to change specific values of a modular input's inputs.conf from within the modular input itself. As an example, let's say $SPLUNK_HOME/etc/apps/my_app/local/inputs.conf contains:
[my_app://TestInput]
key = value
key_alt = value_alt
A GET request (authenticated with a session_key retrieved from STDIN within my modular input) to /services/data/inputs/my_app/TestInput will return the fields along with a ton of extra data, no problem whatsoever. My issues start when I try to modify the fields - say I want to change the key_alt value to alternative . I'm doing via a POST request to the same URI with POST-encoded variables:
key=value
key_alt=alternative
So far so good - the server doesn't complain and if I send another GET request to /services/data/inputs/my_app/TestInput the data will reflect the last change. However, instead of actually modifying the value of $SPLUNK_HOME/etc/apps/my_app/local/inputs.conf , Splunk writes the change in $SPLUNK_HOME/etc/apps/search/local/inputs.conf as:
[my_app://TestInput]
key_alt = alternative
Furthermore (and not too much important), if I am to delete this entry manually, the STDIN configuration for my modular input will still reflect the change forcing me to conclude that there must be some sort of a flush method that I can call to refresh the configuration my modinput receives through STDIN ?
But my primary concern is how to force the REST API /services/data/inputs/ endpoint to edit the right inputs.conf (the one it gets the fields from) instead of reaching for the top-level one in /apps/search/local
Any ideas?
... View more