Create Config
create_configCreate or update a stanza in a Splunk .conf file at the app level, using REST with SDK fallback. Add or modify keys, with overwrite control to preserve existing settings.
Instructions
Creates or updates a stanza in a Splunk .conf file at the app level. Uses REST first, with SDK fallback. Defaults to the current session owner and app 'search' when not provided. Will only overwrite existing keys when overwrite=true; otherwise, only new keys are added.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| app | No | App namespace for the config (defaults to 'search' if not provided). | |
| owner | No | Owner namespace (defaults to current session user if available). | |
| stanza | Yes | Stanza name to create/update. | |
| settings | Yes | Key/value settings to apply in the stanza. | |
| conf_file | Yes | Configuration file name without .conf (e.g., 'props', 'transforms'). | |
| overwrite | No | Overwrite existing keys if True; otherwise skip them. |