Archive
Highlighted

Need help with Splunk REST command, Get property value from configuration file

SplunkTrust
SplunkTrust

Hi All,

I am trying to write a search to get values from the configuration file. An example of it will be to the minFreeSpace property from server.conf (under diskUsage stanza).

So far I have written:

| rest /services/properties/server/diskUsage 

This gives me list of properties defined under diskUsage stanza, but value for each property is not shown.

"author" "id                                       "published"  "splunk_server"     "title"     "updated"
"blank" "<someurl>diskUsage/minFreeSpace"          "blank"      "myhost"         "minFreeSpace" "somedate"
"blank" "<someurl>diskUsage/pollingFrequency"      "blank"      "myhost"       "pollingFrequency"   "somedate"
"blank" "<someurl>diskUsage/pollingTimerFrequency" "blank"      "myhost"      "pollingTimerFrequency"   "somedate"

Could anyone help me how to get the values too.
I tried with "|REST /services/properties/server/diskUsage/minFreeSpace" but it shows no result.

Tags (2)
Highlighted

Re: Need help with Splunk REST command, Get property value from configuration file

SplunkTrust
SplunkTrust

I can't test this right now, but you might be trapped in namespace hell. Give it a shot to play around with the various servicesNS options.

Your second URL with the stanza and key should be the only properties endpoint to actually report a value, once namespace stuff is sorted out.

As an alternative, take a look at the configs/conf-server endpoint.

0 Karma
Highlighted

Re: Need help with Splunk REST command, Get property value from configuration file

Path Finder

I opened a support ticket on a similar issue. Until the latest release (v6.0.2) the rest search command would not return text value elements included in the response. This behavior is now fixed.

View solution in original post

Highlighted

Re: Need help with Splunk REST command, Get property value from configuration file

SplunkTrust
SplunkTrust

I was using Splunk 5.0.5 but planning to upgrade to Splunk 6.x. Thanks for the update.

0 Karma