topic Help to list the .conf files from conf objects in Splunk Enterprise

Help to list the .conf files from conf objects

PraveenaR — Wed, 09 Feb 2022 19:11:10 GMT

I need to get the list of .conf files.

On running my below Splunk Query,

"| rest /services/configs/conf-props"

it returns the conf objects, but I need to find the .conf files instead of objects.

Any help would be appreciated!

Thanks!

Re: To list the .conf files from conf objects

richgalloway — Wed, 09 Feb 2022 14:58:06 GMT

Try | rest /servicesNS/-/-/properties

Re: To list the .conf files from conf objects

PraveenaR — Fri, 11 Feb 2022 13:35:19 GMT

Thanks for quick response!

I need to display both config files and views in a single query.

My Below queries work fine if I run seperately,

Queries:

1. | rest splunk_server=local /servicesNS/-/-/data/ui/views
| table eai:acl.sharing eai:acl.owner id
| rename eai:acl.owner as owner, eai:acl.sharing AS sharing

2. | rest /servicesNS/-/-/properties

My use case is to display both config files and views together with updated time.

Any help would be appreciated!

Thanks!

Re: To list the .conf files from conf objects

richgalloway — Fri, 11 Feb 2022 15:00:37 GMT

The challenge is finding common field values between the two queries so you can merge their results.

BTW, Splunk rarely updates the Updated field so I wouldn't try to use it for anything.

Re: To list the .conf files from conf objects

PraveenaR — Thu, 17 Feb 2022 14:35:18 GMT

@richgalloway ,

The query you mentioned helps to display the properties as config objects, but not as files.

My use case is to list as files from the config objects listed.

Any help on this would be appreciated.

Thanks!

Re: To list the .conf files from conf objects

PraveenaR — Thu, 17 Feb 2022 14:46:45 GMT

@richgalloway ,

In similar way I need to list all the macros as files instead of config objects.

Any help would be appreciated.

Thanks!

Re: To list the .conf files from conf objects

isoutamo — Thu, 17 Feb 2022 15:14:30 GMT

I think that you can found answers from this conf presentation:

r. Ismo