[augeas-devel] Creation of plugin for Splunk configurations

[Elias Ross]

I ran a problem with needing to change a Splunk configuration file. I
use Puppet to install Splunk and primarily I'm interested in changing
just one file using its Augeas support but there is no lens. The
problem is explained mostly here:
http://splunk-base.splunk.com/answers/31010/ssl-is-working-for-forwarder-indexer-but-not-deployment-client-server-traffic

Internet search leads me to think people do want to use Augeas for
this, but it hasn't been written by anybody.

I tried using the default ini format, but this doesn't allow for / in
the section titles, which breaks things.

IRC chat I had:

genman	I need help matching an .ini file with / in the section title ,
e.g. [tcp://9997]
	Dominic	genman: sorry, I'm just heading off but will quickly say: you
won't be able to store that as the node "key", only as a value
	genman	you can't do some tricky string manipulation I guess to change
/ to _ and visa-versa? hmm
	Dominic	node names/keys can only contain fairly simple strings as
they're used in paths. Usually the inifile lens will store section
titles as node names.
	Dominic	no
	Dominic	so you'd do: [ Util.del_str "[" . label "section" . store
/[^\]]+/ . Util.del_str "]" ] or similar I guess
	Dominic	if nobody else is around, then feel free to e-mail the list
at augeas-devel at redhat.com
	genman	okay, thanks ... I think an email would be better

So although I can kind of figure out what to do, if you had a good
example of how to do this, I would like to try it out.

The grammar is roughly like this:


(* Splunk module for Augeas
 Author: Elias Ross <genman at noderunner.net>

 splunk files are standard INI File.
*)


module Splunk =
  autoload xfm

(************************************************************************
 * INI File settings
 *
 * splunk.conf only supports "# as commentary and "=" as separator
 *************************************************************************)
let comment    = IniFile.comment "#" "#"
let sep        = IniFile.sep "=" "="

(************************************************************************
 *                        ENTRY
 * splunk.conf uses standard INI File entries
 *************************************************************************)
let entry   = IniFile.indented_entry IniFile.entry_re sep comment


(************************************************************************
 *                        RECORD
 * splunk.conf uses standard INI File records
 *************************************************************************)
let record_re = /[^]\n]+/
let title   = IniFile.indented_title record_re
let record  = IniFile.record title entry


(************************************************************************
 *                        LENS & FILTER
 * splunk.conf uses standard INI File records
 *************************************************************************)
let lns     = IniFile.lns record comment

let filter =
        (incl "/opt/splunk/etc/system/local/*.conf")
      . (incl "/opt/splunk/etc/users/*/search/local/*.conf")
      . (incl "/opt/splunk/etc/apps/*/local/*.conf")
      . (incl "/opt/splunk/etc/modules/*/classes/deployable/*.conf")
      . (incl "/opt/splunkforwarder/etc/system/local/*.conf")
      . Util.stdexcl

let xfm = transform lns filter