create_config
Create or update a stanza in a Splunk .conf file at the app level, adding or overwriting key-value settings with REST-first approach.
Instructions
Creates or updates a stanza in a Splunk .conf file at the app level. Uses REST first, with SDK fallback. Defaults to the current session owner and app 'search' when not provided. Will only overwrite existing keys when overwrite=true; otherwise, only new keys are added.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| conf_file | Yes | Configuration file name without .conf (e.g., 'props', 'transforms'). | |
| stanza | Yes | Stanza name to create/update. | |
| settings | Yes | Key/value settings to apply in the stanza. | |
| app | No | App namespace for the config (defaults to 'search' if not provided). | |
| owner | No | Owner namespace (defaults to current session user if available). | |
| overwrite | No | Overwrite existing keys if True; otherwise skip them. |