topic Re: Manipulate conf file through Splunk/Rest API in Splunk Dev

Manipulate conf file through Splunk/Rest API

klausJohan — Wed, 09 Oct 2013 20:37:38 GMT

Hi,

Is there any experience around to be shared concerning how to programmatically manipulate (read, update) through Splunk API or REST API a custom conf file (say "myapp.conf").

Cheers

Re: Manipulate conf file through Splunk/Rest API

sowings — Wed, 09 Oct 2013 20:46:23 GMT

I'd start with trying the | rest search command in Splunk. It would at least tell you if your custom config file is reachable by the REST endpoint. Try: | rest /services/configs/conf-myapp (or optionally, constrain the app and user: | rest /servicesNS/admin/myapp/configs/conf-myapp).

Note that any POSTs to define settings don't have restrictions on the keys, that's up to your app to define. More docs about the POST (and an example) can be found here:

http://docs.splunk.com/Documentation/Splunk/6.0/RESTAPI/RESTconfig

Re: Manipulate conf file through Splunk/Rest API

klausJohan — Thu, 10 Oct 2013 08:08:24 GMT

Yes, through "| rest ..." I can see my conf file. But the get/post request with curl or from the browser return no result

Re: Manipulate conf file through Splunk/Rest API

sowings — Thu, 10 Oct 2013 13:15:45 GMT

How did you issue the curl call?

I created a new config 'myconfig' and a corresponding 'myconfig.conf.spec' in the README subdir of my app. After that, I was able to

curl -k -u admin:pass https://127.0.0.1:8089/servicesNS/admin/fire_brigade/configs/conf-myconfig

I only mention the README subdir because I didn't try it without. Did you get an error from the curl call? I got an XML response that contained the config key. Note also that I restarted Splunk after adding the config file and the README/myconfig.conf.spec. I'm not sure if that was required, but....

Re: Manipulate conf file through Splunk/Rest API

klausJohan — Fri, 11 Oct 2013 16:52:10 GMT

Eventually it worked with curl also.