Getting Data In

Is there a way to get inputs.conf on the deployment server via the rest API?

ddrillic
Ultra Champion

We can reach via

https://<deployment server>:8089/services/deployment/server/applications/<app name>

to the deployment app level. However, we would like to reach the inputs.conf which is under the local directory and we can't find it. Is it possible, by any chance?

Tags (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi ddrillic,
to monitor my Deployment Server I created a report that uses a rest command and save output in a file read by an input and sent to Indexers.

At the same time, I read all the .conf files in Deployment Server and I show them in an App on Search Head.
This is useful for me when i have new inputs and I want to be sure that the input is not existing.

If you want I can share my report and inputs.conf tomorrow.

Bye.

0 Karma

ddrillic
Ultra Champion

If you can @gcusello, it would be great.

0 Karma

koshyk
Super Champion

Please have a try using

| rest splunk_server=<yourdeploymentserver> /servicesNS/admin/<your_app>/configs/conf-inputs

If you are doing within the deployment-server, you can do splunk_server=local

ddrillic
Ultra Champion

No luck with that @koshyk. I get 0 results for it...

0 Karma

koshyk
Super Champion

hi mate, you sure you are on deployment-server (or the main server attached to deployment-server)?
In our case, we cannot do it from search heads, but only on the deployment server UI

0 Karma

ddrillic
Ultra Champion

Right, I'm on the deployment-server.

0 Karma

koshyk
Super Champion

Can you please try for an APP, which is part of default setting? Like "search" app or a generic app. just to ensure it is not permission related. ANY server should show it

0 Karma

ddrillic
Ultra Champion

@koshyk, sorry, trying a different route.

This one worked for sanity connection check -

curl -k -u user:passwrd https://<deployment server>:8089/services

Against the app -

$ curl -k -u user:passwrd https://<deployment server>:8089/servicesNS/admin/<deployment app>/configs/conf-inputs

<?xml version="1.0" encoding="UTF-8"?>
<response>
  <messages>
    <msg type="ERROR">Application does not exist: <deployment app></msg>
  </messages>
</response>
0 Karma

koshyk
Super Champion

@drillic, you shouldn't put <deployment app>. I've provided as a placeholder example. You need to put the actual name of your app

for eg. search app
| rest /servicesNS/admin/search/configs/conf-inputs

0 Karma

ddrillic
Ultra Champion

I did so @koshyk

0 Karma

ddrillic
Ultra Champion

I had a nice call with our SE, who concluded that the conventional rest calls don't cover the deployment server apps as they are not memory resident.

0 Karma

ddrillic
Ultra Champion

For the record, our SE said -

-- .. Just that the deployment server's interactions with the API is unique, as the API (as far as I could tell) is looking at the active configuration files (/apps), not the deployment configs.

I don't believe we have an existing endpoint to do what you want,...

0 Karma

dstaulcu
Builder

ive worked with windows garbage (propriety data stores for config files) most of my career and can finally use github and jenkins to great effect for my splunk configs. have you thought of automating at that level of abstraction?

0 Karma

pruthvikrishnap
Contributor
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...