Edit props.conf programatically

[strive]

Hi,

We are using splunk 4.3.4. Is it possible to programmatically edit props.conf under deployment-apps directory.

Thanks

Strive

[sowings]

There is a RESTful API for Splunk, and you can use it to update configuration files. What I don't know is whether you can use the API to update configuration files in the deployment-apps hierarchy, as it would tend to write to the active apps instead.

More information about the REST API can be found here:

http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTlist

[sd23c109]

Hi Strive,

What is the MYSQL DB for? What "java" program are you referring to? I am not sure you need a REST API to update the conf file, but I would like to understand more about this REST API.

Thanks,

Chris Schaft
MKAdvantage

[strive]

Hi jKat,

I do a field update on MYSQL database. At this time, I need to update the conf file present in deployment-apps from java program. Using some kind of REST API.

Thanks
Strive

[sd23c109 · Accepted solution]

Hi Strive,

Since the .conf files are all text files, any "sed" type of program would work along with the staple scripting languages like PERL, Python, Ruby, etc. You can create a copy of the .conf file, make your changes based on what you put in the script, then push the changes to where ever you have your deployment server looking for new .conf files and bingo, done. Is this what you mean by "programmatically" edit?

Chris

[Ayn]

As far as I know you cannot access the apps in the deployment-apps directory through the REST API.

[strive]

Hi Chris,

I do a field update on MYSQL database. At this time, I need to update the conf file present in deployment-apps from java program. Using some kind of REST API. Then fschange of splunk takes these changes from deployment-apps and deploy to apps of respective nodes.

Thanks
Strive

[jkat54]

Please explain what you mean by "programmatically edit".