How to query config files using SPL?

cwhelan — Wed, 12 Apr 2023 16:39:52 GMT

Hi guys,

I am currently troubleshooting some processing queue blocking issues (typing queue specifically). I need to view the current typing queue size - [queue=typingQueue] from /opt/splunk/etc/system/local/server.conf although I do not have access to SSH into the Indexer to view this config file directly.

Is it possible to pull/view a full config file (server.conf/inputs.conf etc.) from a specific host by running an SPL query on the SH?

Cheers,

Re: Querying config files using SPL

gcusello — Tue, 11 Apr 2023 12:53:59 GMT

Hi @cwhelan,

it isn't possible to query the configuration files, but you could find if there are some full queue using this search:

index=_internal source=*metrics.log sourcetype=splunkd group=queue | eval name=case(name=="aggqueue","2 - Aggregation Queue", name=="indexqueue", "4 - Indexing Queue", name=="parsingqueue", "1 - Parsing Queue", name=="typingqueue", "3 - Typing Queue", name=="splunktcpin", "0 - TCP In Queue", name=="tcpin_cooked_pqueue", "0 - TCP In Queue") | eval max=if(isnotnull(max_size_kb),max_size_kb,max_size) | eval curr=if(isnotnull(current_size_kb),current_size_kb,current_size) | eval fill_perc=round((curr/max)*100,2) | bin _time span=1m | stats Median(fill_perc) AS "fill_percentage" max(max) AS max max(curr) AS curr by host, _time, name | where (fill_percentage>70 AND name!="4 - Indexing Queue") OR (fill_percentage>70 AND name="4 - Indexing Queue") | sort -_time

Ciao.

Giuseppe

topic How to query config files using SPL? in Monitoring Splunk

How to query config files using SPL?

Re: Querying config files using SPL