Getting Data In

Can you make .conf changes with the rest API?

Log_wrangler
Builder

Has anyone used the rest API to successfully edit a conf file?

I understand there are 3 methods GET, POST, DELETE.
I understand one can manipulate searches but I am unfamiliar with managing objects and configurations with the API.

Any advice or examples would be awesome.

Thank you

Tags (3)
0 Karma
1 Solution

renjith_nair
Legend

@Log_wrangler,

You can edit conf with rest API

For e.g.

curl -k -u admin:pass https://localhost:8089/servicesNS/nobody/search/configs/conf-props \
    -d name=myweblogs \
    -d CHARSET=UTF-8 \
    -d SHOULD_LINEMERGE=false

In the above, if the stanza myweblogs does not exist, then it creates a new one and if it exists, it updates it with the value you provided.

Detailed documentation is available in http://docs.splunk.com/Documentation/Splunk/latest/RESTTUT/RESTconfigurations

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@Log_wrangler,

You can edit conf with rest API

For e.g.

curl -k -u admin:pass https://localhost:8089/servicesNS/nobody/search/configs/conf-props \
    -d name=myweblogs \
    -d CHARSET=UTF-8 \
    -d SHOULD_LINEMERGE=false

In the above, if the stanza myweblogs does not exist, then it creates a new one and if it exists, it updates it with the value you provided.

Detailed documentation is available in http://docs.splunk.com/Documentation/Splunk/latest/RESTTUT/RESTconfigurations

---
What goes around comes around. If it helps, hit it with Karma 🙂

serjandrosov
Path Finder
0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and stall ...

Print, Leak, Repeat: UEBA Insider Threats You Can't Ignore

Are you ready to uncover the threats hiding in plain sight? Join us for "Print, Leak, Repeat: UEBA Insider ...

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...