topic Re: Need help with Splunk REST command, Get property value from configuration file in Splunk Search

Need help with Splunk REST command, Get property value from configuration file

somesoni2 — Thu, 20 Feb 2014 15:17:16 GMT

Hi All,

I am trying to write a search to get values from the configuration file. An example of it will be to the minFreeSpace property from server.conf (under diskUsage stanza).

So far I have written:

| rest /services/properties/server/diskUsage

This gives me list of properties defined under diskUsage stanza, but value for each property is not shown.

"author" "id                                       "published"  "splunk_server"     "title"     "updated"
"blank" "<someurl>diskUsage/minFreeSpace"          "blank"      "myhost"         "minFreeSpace" "somedate"
"blank" "<someurl>diskUsage/pollingFrequency"      "blank"      "myhost"       "pollingFrequency"   "somedate"
"blank" "<someurl>diskUsage/pollingTimerFrequency" "blank"      "myhost"      "pollingTimerFrequency"   "somedate"

Could anyone help me how to get the values too.
I tried with "|REST /services/properties/server/diskUsage/minFreeSpace" but it shows no result.

Re: Need help with Splunk REST command, Get property value from configuration file

martin_mueller — Thu, 20 Feb 2014 23:20:46 GMT

I can't test this right now, but you might be trapped in namespace hell. Give it a shot to play around with the various servicesNS options.

Your second URL with the stanza and key should be the only properties endpoint to actually report a value, once namespace stuff is sorted out.

As an alternative, take a look at the configs/conf-server endpoint.

Re: Need help with Splunk REST command, Get property value from configuration file

fervin — Thu, 06 Mar 2014 01:06:02 GMT

I opened a support ticket on a similar issue. Until the latest release (v6.0.2) the rest search command would not return text value elements included in the response. This behavior is now fixed.

Re: Need help with Splunk REST command, Get property value from configuration file

somesoni2 — Thu, 06 Mar 2014 21:44:12 GMT

I was using Splunk 5.0.5 but planning to upgrade to Splunk 6.x. Thanks for the update.