topic Re: Script to lint and validate splunk config? in Splunk Enterprise

Is there any script to lint and validate splunk config?

muebel — Tue, 19 Apr 2022 16:50:36 GMT

Do any of you use (or know of) any scripts that look at splunk configuration and point out errors, or otherwise allow for a framework to do some sanity checking? This is a fairly open question, and I'd also love any ideas for what kind of things you'd like to see in such a script.

Re: Script to lint and validate splunk config?

tscroggins — Sat, 16 Apr 2022 16:21:41 GMT

@muebel

btool includes a "check" command, which I believe does simple .conf.spec validation, similar to Splunk startup.

AppInspect includes various checks.

The official Visual Studio Code Extension for Splunk includes .conf linting. I've not used it, so I can't comment on its quality or accuracy.

How deep down the lint rabbit hole do you plan to go? It's perhaps too late to break PC-lint's continuously advertised software record. 😉 (I do miss Dr. Dobb's Journal.)

Re: Any script to lint and validate splunk config?

VatsalJagani — Mon, 18 Apr 2022 17:35:25 GMT

@muebel - How about btool?

./splunk btool check

Re: Script to lint and validate splunk config?

muebel — Mon, 18 Apr 2022 19:52:45 GMT

hmm it appears that check doesn't work when also using the --dir flag

Re: Script to lint and validate splunk config?

muebel — Mon, 18 Apr 2022 20:23:37 GMT

with some help from @mmccul in slack I was able to figure this out.

btool is expecting a specific directory structure, and is looking for the spec files to be found in `system/README` from what is specified as the `--dir` target.

It also only looks in directories named like the normal config directories ( apps, master-apps etc)

Re: Is there any script to lint and validate splunk config?

haraksin — Wed, 25 Jun 2025 01:30:35 GMT

I usually use a combination of the .conf VSCode linter that others have suggested for writing, and then upon committing I have AppInspect and the Splunk Packaging Tool run for my apps, and this keeps them bug free and knowing that I will pass cloud verification. I will also drop these since I wrote them and am biased, but I use them myself for writing SPL in VSCode: Splunk Search Syntax Highlighter Extension and Splunk Search Autocompletion Tool