topic how to load/save files under $Splunk\etc\users\USER_NAME\APP_NAME in Security

how to load/save files under $Splunk\etc\users\USER_NAME\APP_NAME

William — Tue, 08 Jun 2010 10:41:34 GMT

i have extended a Splunk module, and in it i would like to load/save some data. moreover, i want to bind that data to both the user and the app. so, i think "$Splunk\etc\users\USER_NAME\APP_NAME" is a good place for this kind of files.

But how to do declare the path? and how to do this?

Re: how to load/save files under $Splunk\etc\users\USER_NAME\APP_NAME

Stephen_Sorkin — Sun, 22 Aug 2010 05:43:32 GMT

You should not modify files directly from your module. It's a better idea to use splunkd's REST API to modify files. Specifically, if you POST to https://server:port/servicesNS/<user>/<app>/admin/conf-<conf-file>;, you'll create entries in $SPLUNK_HOME/etc/users/<user>/<app>/local/<conf-file>.conf. You can create a stanza named foo with a line key=value by POSTing name=foo&key=value. You can read this stanza at servicesNS/<user>/<app>/admin/conf-<conf-file>/<stanza>.

Helpers for reading and writing from these can be found in entities.py which ships with Splunk.

Note that this method is not officially supported.

Re: how to load/save files under $Splunk\etc\users\USER_NAME\APP_NAME

William — Sun, 26 Sep 2010 14:19:43 GMT

i've solved this problem by adding some python modules and modifying somewhere in the splunk needed. but its compatibility is bad.

I haven't tried your method. Maybe for the next time, i have to do things like this. Thanks anyway.