topic How do I edit configuration files through Splunk Web? in Security

How do I edit configuration files through Splunk Web?

jarrett15 — Wed, 31 Aug 2016 16:35:27 GMT

I would like to edit configuration files through Splunk Web instead of an editor. How do I do this?

Re: How do I edit configuration files through Splunk Web?

somesoni2 — Wed, 31 Aug 2016 16:50:02 GMT

AFAIK, there is no native option to update the conf file directly. From many activities in Splunk Web, the conf files will get update, so what all conf files/entries you're looking to update from Splunk Web?

Re: How do I edit configuration files through Splunk Web?

jarrett15 — Wed, 31 Aug 2016 16:54:47 GMT

I am looking to edit the inputs and props files

Re: How do I edit configuration files through Splunk Web?

somesoni2 — Wed, 31 Aug 2016 17:03:07 GMT

If you're in 6.3 OR above, you can update props.conf from Settings->Source types (for sourcetype definitation) OR Settings-> Fields (for field extractionos/transformation).
Inputs.conf can be update (indirectly) from UI Settings->Data Inputs, for regular properties. The advanced properties should be updated only by Splunk Administrators who have in-depth knowledge about those properties, hence they are not exposed via UI.

Re: How do I edit configuration files through Splunk Web?

masonmorales — Wed, 31 Aug 2016 17:46:06 GMT

Converted to answer

Re: How do I edit configuration files through Splunk Web?

jarrett15 — Thu, 01 Sep 2016 02:28:00 GMT

thank you somesoni2. thats what i needed to know.

Re: How do I edit configuration files through Splunk Web?

satishachary199 — Wed, 04 Apr 2018 17:54:18 GMT

I want to update data masking regex expression in the props.conf file through splunk UI.

Re: How do I edit configuration files through Splunk Web?

satishachary199 — Wed, 04 Apr 2018 17:55:34 GMT

Hi somesoni2,
Thanks for your information, but i not found any option which can be update my props.conf file ,through which i will use data masking regex expression.

Re: How do I edit configuration files through Splunk Web?

pfender — Tue, 04 Jun 2019 11:19:09 GMT

Config Explorer

https://splunkbase.splunk.com/app/4353/