topic Re: How to view the Indexes.conf parameters from a SPL statement? in Splunk Enterprise

How to view the Indexes.conf parameters from a SPL statement?

itsmevic — Tue, 22 Feb 2022 21:24:27 GMT

Hello Splunkers!

How would one view the parameters of the indexes.conf by using a SPL statement? The below SPL statement doesn't seem to work. Any help is greatly appreciated!

| rest splunk_server=<hostname>/services/configs/conf-indexes
| transpose

Re: How to view the Indexes.conf parameters from a SPL statement?

Stefanie — Tue, 22 Feb 2022 21:29:14 GMT

The query works for me. Are you putting a space between the hostname and /services/configs/conf-indexes?

Maybe another option is to use the commandline and use btool?

$SPLUNK_HOME/bin/splunk btool indexes list

Re: How to view the Indexes.conf parameters from a SPL statement?

itsmevic — Tue, 22 Feb 2022 21:40:13 GMT

I would totally agree with you on any other occasion; however, If I had access to the backend, I def would be running your CLI suggestion, but I do not, so I need to do this through the front end.

Re: How to view the Indexes.conf parameters from a SPL statement?

itsmevic — Tue, 22 Feb 2022 21:43:13 GMT

Let me try the query again, maybe I fat-fingered it.

Re: How to view the Indexes.conf parameters from a SPL statement?

m_pham — Fri, 25 Feb 2022 05:23:29 GMT

I copied your SPL and it didn't have a space between the endpoint and splunk_server values. Can you try this?

| rest splunk_server=<my_hosts> /services/configs/conf-indexes