create_config
Create or update configuration stanzas in Splunk .conf files at the app level using REST API or SDK fallback. Manage settings with optional overwrite control for existing keys.
Instructions
Creates or updates a stanza in a Splunk .conf file at the app level. Uses REST first, with SDK fallback. Defaults to the current session owner and app 'search' when not provided. Will only overwrite existing keys when overwrite=true; otherwise, only new keys are added.
Args: conf_file (str): Configuration file name without .conf (e.g., 'props', 'transforms'). stanza (str): Stanza name to create/update. settings (dict): Key/value settings to apply in the stanza. app (str, optional): App namespace for the config (defaults to 'search' if not provided). owner (str, optional): Owner namespace (defaults to current session user if available). overwrite (bool, optional): Overwrite existing keys if True; otherwise skip them.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| conf_file | Yes | ||
| stanza | Yes | ||
| settings | Yes | ||
| app | No | ||
| owner | No | ||
| overwrite | No |