topic Re: Edit props.conf programatically in Dashboards & Visualizations

Edit props.conf programatically

strive — Mon, 26 Nov 2012 10:56:00 GMT

Hi,

We are using splunk 4.3.4. Is it possible to programmatically edit props.conf under deployment-apps directory.

Thanks

Strive

Re: Edit props.conf programatically

jkat54 — Mon, 26 Nov 2012 13:30:17 GMT

Please explain what you mean by "programmatically edit".

Re: Edit props.conf programatically

sd23c109 — Mon, 26 Nov 2012 13:59:40 GMT

Hi Strive,

Since the .conf files are all text files, any "sed" type of program would work along with the staple scripting languages like PERL, Python, Ruby, etc. You can create a copy of the .conf file, make your changes based on what you put in the script, then push the changes to where ever you have your deployment server looking for new .conf files and bingo, done. Is this what you mean by "programmatically" edit?

Chris

Re: Edit props.conf programatically

strive — Tue, 27 Nov 2012 16:19:59 GMT

Hi jKat,

I do a field update on MYSQL database. At this time, I need to update the conf file present in deployment-apps from java program. Using some kind of REST API.

Thanks
Strive

Re: Edit props.conf programatically

strive — Tue, 27 Nov 2012 16:24:29 GMT

Hi Chris,

I do a field update on MYSQL database. At this time, I need to update the conf file present in deployment-apps from java program. Using some kind of REST API. Then fschange of splunk takes these changes from deployment-apps and deploy to apps of respective nodes.

Thanks
Strive

Re: Edit props.conf programatically

sd23c109 — Tue, 27 Nov 2012 16:40:07 GMT

Hi Strive,

What is the MYSQL DB for? What "java" program are you referring to? I am not sure you need a REST API to update the conf file, but I would like to understand more about this REST API.

Thanks,

Chris Schaft
MKAdvantage

Re: Edit props.conf programatically

sowings — Tue, 27 Nov 2012 16:44:54 GMT

There is a RESTful API for Splunk, and you can use it to update configuration files. What I don't know is whether you can use the API to update configuration files in the deployment-apps hierarchy, as it would tend to write to the active apps instead.

More information about the REST API can be found here:

http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTlist

Re: Edit props.conf programatically

Ayn — Tue, 27 Nov 2012 20:52:34 GMT

As far as I know you cannot access the apps in the deployment-apps directory through the REST API.