How can I automatically create a view based on xml in /views folder?
example:
put xml file in here.
$SPLUNK_HOME/etc/apps/ /local/data/ui/views/
I want to avoid having to create a view using Splunk Web GUI every time. I would prefer to dump the custom xml and have the view automatically created. I also want to avoid using additional Splunk Apps.
It doesn't seem like xml can be dumped into the folder and simply point to the view url. There is still backend Splunk creation that needs to take place currently for this to work.
Example:
When I dump xml in folder I want to be able to simply go to a url: splunkur:8000/en-GB/app/search/xml-view-name-here
Update:
Based on Drainy's post, dumping xml files into the view folder DOES work, however the cache needs to re-read or re-indexed.
The simple solution right now is: click the app logo top left to re-read the cache (but this is obviously not the most desired solution).
The real solution: force a re-read of the xml cache (or whatever cache in splunk web backend).
Note
Looking into this more and hoping that Drainy will provide the python script!
Will the python script be something I can trigger to run into the nix cli?
For example: As it stands I have a trigger set when I dump my new csv file and new xml into splunk folders, I force a re-index with the oneshot splunk command. Will the scenario be the same for the python script?
Greatly appreciated!
... View more