Getting Data In

How to find .conf files on a splunk interface which is only accessible via a URL?

hunterpj
Path Finder

I need to locate the savedsearches.conf on a Splunk web server i.e. I can only reach this Splunk instance with a URL. if there is an app that allows this to happen that would be great too. I essentially want to copy/paste these alerts from the online instance to another instance, however I can only obtain the saved search properties via job inspection, which isn't in the format I want.

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi hunterpj,

you can always use REST calls if you have the privilege to use them:

 | REST splunk_server=local /servicesNS/-/-/saved/searches/

will give you a list of the saved searches that are not private.

There is also an App called Web Terminal https://splunkbase.splunk.com/app/1607/ which allows you to use btool from the Splunk UI and therefore use this command to list all saved searches from any savedsearches.conf

splunk cmd btool savedsearches list --debug

remember you need to exclude all default settings from this output.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi hunterpj,

you can always use REST calls if you have the privilege to use them:

 | REST splunk_server=local /servicesNS/-/-/saved/searches/

will give you a list of the saved searches that are not private.

There is also an App called Web Terminal https://splunkbase.splunk.com/app/1607/ which allows you to use btool from the Splunk UI and therefore use this command to list all saved searches from any savedsearches.conf

splunk cmd btool savedsearches list --debug

remember you need to exclude all default settings from this output.

Hope this helps ...

cheers, MuS

hunterpj
Path Finder

Is there any way to view the configurations file directly using the REST API? This helps, but isn't in the format of the savedsearches.conf as shown in the local savedsearches.conf file I have on my local instance. I am currently trying to use the REST API command configs/conf-{file}/{name}, but its not working for me.

0 Karma

MuS
SplunkTrust
SplunkTrust

Might be a permission issue.
If you can use the Web Terminal and run btool you would get a list that you can use to copy / paste.

cheers, MuS

0 Karma

hunterpj
Path Finder

Thank you for your help, this works.

0 Karma

hunterpj
Path Finder

As another note for anyone who comes along, I used in the Web Terminal the command:
btool savedsearches list --app=SPLUNK_APP

It works really well in isolating the alerts you want by app.

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...