ksconf minimize

See also

See the Minimizing files for background on why this is important.

Minimize a conf file by removing the default settings

Reduce local conf file to only your indented changes without manually tracking which entries you’ve edited. Minimizing local conf files makes your local customizations easier to read and often results in cleaner add-on upgrades.

usage: ksconf minimize [-h] [--target TARGET] [--dry-run | --output OUTPUT]
                       [--explode-default] [-k PRESERVE_KEY]
                       CONF [CONF ...]

Positional Arguments

CONF	The default configuration file(s) used to determine what base settings are unnecessary to keep in the target file.

Named Arguments

--target, -t	The local file that you wish to remove duplicate settings from. By default, this file will be read from and then updated with a minimized version.
--dry-run, -D	Enable dry-run mode. Instead of writing the minimizing the TARGET file, preview what would be removedthe form of a ‘diff’.
--output	Write the minimized output to a separate file instead of updating TARGET. This option can be used to preview the actual changes. Sometimes if --dry-run mode produces too much output, it’s helpful to look at the acutal minimized version of the file in concrete form (rather than a relative format, like a diff. This may also be helpful in other workflows.
--explode-default, -E
	Enable minimization across stanzas as well as files for special use-cases This mode will not only minimize the same stanza across multiple config files, it will also attempt to minimize any default values stored in the [default] or global stanza as well. For this to be effective, it’s often necessary to include system default in the CONF list. For example, to trim out cruft in savedsearches.conf, make sure you add etc/system/default/savedsearches.conf as an input.
-k, --preserve-key
	Specify attributes that should always be kept.

Example usage

cd Splunk_TA_nix
cp default/inputs.conf local/inputs.conf

# Edit 'disabled' and 'interval' settings in-place
vi local/inputs.conf

# Remove all the extra (unmodified) bits
ksconf minimize --target=local/inputs.conf default/inputs.conf

For special cases, the --explode-default mode reduces duplication between entries normal stanzas and global/default entries. If disabled = 0 is a global default, it’s technically safe to remove that setting from individual stanzas. But sometimes it’s preferable to be explicit, and this behavior may be too heavy-handed for general use so it’s off by default. Use this mode if you need your conf file that’s been fully-expanded. (i.e., conf entries downloaded via REST, or the output of “btool list”). This isn’t perfect, since many apps push their settings into the global namespace, but it can help. In many ways this process mimics what Splunk does every time it updates a conf file. The difference being that Splunk always has the full context, for this command to work most effectively, it really need to be given all the layers of default (system, app level, and so on). Also keep in mind that when ksconf load this formation, it isn’t taking ACLs into consideration (the individual conf files are not linked to their metadata counterparts) so your results may vary from what a live Splunk system would do. Just something to think about. (Probably not a big deal since this is all on the fringes.)