splunk:
  conf:
    - key: ui-tour
      value:
        directory: /opt/splunk/etc/system/local
        content:
          default:
            useTour: false
    - key: limits
      value:
        directory: /opt/splunk/etc/system/local
        content:
          default:
            max_mem_usage_mb: 0
    - key: times
      value:
        directory: /opt/splunk/etc/system/local
        content:
          last_minute:
            label: Last minute
            header_label: in the last minute
            earliest_time: -1m
            order: 1
          last_5_minutes:
            label: Last 5 minutes
            header_label: in the last minute
            earliest_time: -5m
            order: 2
    - key: user-prefs
      value:
        directory: /opt/splunk/etc/system/local
        content:
          general:
            default_namespace: search
            dismissedInstrumentationOptInVersion: 1
            hideInstrumentationOptInModal: 1
            theme: dark
            search_auto_format: true
    - key: indexes
      value:
        directory: /opt/splunk/etc/manager-apps/_cluster/local
        content:
          xxxxxxx.bre:
            repFactor: auto
          xxxxxxx.fdim:
            repFactor: auto
          xxxxxxx.webapp:
            repFactor: auto
    - key: indexes
      value:
        directory: /opt/splunk/etc/system/local
        content:
          xxxxxxx.bre:
            homePath: $SPLUNK_DB/$_index_name/db
            coldPath: $SPLUNK_DB/$_index_name/colddb
            thawedPath: $SPLUNK_DB/$_index_name/thaweddb
            tstatsHomePath: volume:_splunk_summaries/$_index_name/datamodel_summary
          xxxxxxx.fdim:
            homePath: $SPLUNK_DB/$_index_name/db
            coldPath: $SPLUNK_DB/$_index_name/colddb
            thawedPath: $SPLUNK_DB/$_index_name/thaweddb
            tstatsHomePath: volume:_splunk_summaries/$_index_name/datamodel_summary
          xxxxxxx.webapp:
            homePath: $SPLUNK_DB/$_index_name/db
            coldPath: $SPLUNK_DB/$_index_name/colddb
            thawedPath: $SPLUNK_DB/$_index_name/thaweddb
            tstatsHomePath: volume:_splunk_summaries/$_index_name/datamodel_summary
    - key: props
      value:
        directory: /opt/splunk/etc/system/local
        content:
          default:
            TRUNCATE: 0
            MAX_EVENTS: 10000
          xxxxxxx_log_sourcetype:
            SHOULD_LINEMERGE: false
            LINE_BREAKER: (\s*)\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}[,\.]\d{3}\s\[
          xxxxxxx_api_wfholtrace_sourcetype:
            SHOULD_LINEMERGE: true
            BREAK_ONLY_BEFORE: w3wp.exe
            TIME_PREFIX: DateTime=
            TIME_FORMAT: "%Y-%m-%dT%H:%M:%S.%3N"
          xxxxxxx_webui_wfholtrace_sourcetype:
            SHOULD_LINEMERGE: true
            BREAK_ONLY_BEFORE: \>\>
          xxxxxxx_api_trace_sourcetype:
            SHOULD_LINEMERGE: false
            LINE_BREAKER: (\s*------------------------------------------------------------------------------------------------------------------------------------------------------\s*)
            SEDCMD-removetracedelimiter: s/--\s*//g
          xxxxxxx_svclog_sourcetype:
            SHOULD_LINEMERGE: false
            LINE_BREAKER: (\s*)\<E2ETraceEvent\s
            KV_MODE: XML
            TIME_PREFIX: TimeCreated\sSystemTime="
            TIME_FORMAT: "%Y-%m-%dT%H:%M:%S.%3N"
          xxxxxxx_json_sourcetype:
            SHOULD_LINEMERGE: false
            LINE_BREAKER: ([\r\n]+)\{
            KV_MODE: json
          source::/var/log/xxxxxxx/tomcat/...:
            TZ: US/Eastern
    - key: inputs
      value:
        directory: /opt/splunk/etc/system/local
        content:
          #bre logs
          monitor:///var/log/xxxxxxx/bre/bre.*.Log.log:
            index: xxxxxxx.bre
            sourcetype: xxxxxxx_log_sourcetype
            disabled: 0
          monitor:///var/log/xxxxxxx/bre/bre.*.SoapMessages.log:
            index: xxxxxxx.bre
            sourcetype: xxxxxxx_log_sourcetype
            disabled: 0
          #fdim logs
          monitor:///var/log/xxxxxxx/fdim/fdim.localhost.log:
            index: xxxxxxx.fdim
            sourcetype: xxxxxxx_log_sourcetype
            disabled: 0
          monitor:///var/log/xxxxxxx/fdim/xxxxxxx-message-*.log:
            index: xxxxxxx.fdim
            sourcetype: xxxxxxx_log_sourcetype
            disabled: 0
          #webapp logs
          monitor:///var/log/xxxxxxx/WebApp/Api.*WFHOLTrace.log:
            index: xxxxxxx.webapp
            sourcetype: xxxxxxx_api_wfholtrace_sourcetype
            disabled: 0
          monitor:///var/log/xxxxxxx/WebApp/WebUI_WFHOLTrace.log:
            index: xxxxxxx.webapp
            sourcetype: xxxxxxx_webui_wfholtrace_sourcetype
            disabled: 0
          #webapp catch all monitors
          monitor:///var/log/xxxxxxx/WebApp/*.log:
            index: xxxxxxx.webapp
            sourcetype: xxxxxxx_api_trace_sourcetype
            blacklist: (?>Api.*WFHOLTrace|WebUI_WFHOLTrace).log
            disabled: 0
          monitor:///var/log/xxxxxxx/WebApp/*.json:
            index: xxxxxxx.webapp
            sourcetype: xxxxxxx_json_sourcetype
            disabled: 0
          monitor:///var/log/xxxxxxx/WebApp/*.svclog:
            index: xxxxxxx.webapp
            sourcetype: xxxxxxx_svclog_sourcetype
            disabled: 0