I am trying to get data out of my app.conf file in /local/app.conf or from /default/app.conf
I tried using:
but this ultimately results in a call to btool:
./splunk cmd btool app list
which returns a merged form of app.conf which is not relevant to my particular app.
I would have to issue the command:
./splunk cmd btool --app=myAppNameHere app list
to get the data for my particular app.
But since I'm trying to get the value for "id"... which is my app's name... why would I use my app's name to get my app's name??
So now I am left with the question... how do I get my app's name?
Can you describe your use case a bit more ?
Conf files can be read via the Splunk REST API :
curl -k -u admin:pass https://localhost:8089/servicesNS/admin/yourapp/configs/conf-app
And you can invoke this REST endpoint in a variety of ways depending on your use case (SplunkJS functions , SDK's , splunk.entity Python class etc....)
I am writing a custom app for splunk. Therefore I am in serverside python application code.
Yes, I know the name of my app... I could hardcode the name into my python code.
I was looking for a bit more elegant and less brittle approach to determine the name of my app other than hardcoding a string into my code.
What sort of server side python code ? custom rest endpoint ? search command ? external scripted alert ? cherrypy controller ?
Here is some code to point you in the right direction :
import splunk.entity session_key = 'your session key' entity = splunk.entity.getEntity('/configs/conf-app','package', namespace='yourapp', sessionKey=session_key, owner='nobody') app_id = entity.get('id')