Is there a way to get inputs.conf on the deployment server via the rest API?

[ddrillic]

We can reach via

https://<deployment server>:8089/services/deployment/server/applications/<app name>

to the deployment app level. However, we would like to reach the inputs.conf which is under the local directory and we can't find it. Is it possible, by any chance?

[gcusello]

Hi ddrillic,
to monitor my Deployment Server I created a report that uses a rest command and save output in a file read by an input and sent to Indexers.

At the same time, I read all the .conf files in Deployment Server and I show them in an App on Search Head.
This is useful for me when i have new inputs and I want to be sure that the input is not existing.

If you want I can share my report and inputs.conf tomorrow.

Bye.

[Naa_Win]

Hello @gcusello 

Can you please share the same ? I have a similar use case.

[gcusello]

Hi @Naa_Win ,

try this, even if I did it more than five years ago, but it should still run!

| rest splunk_server=local /services/deployment/server/clients\
| table hostname ip utsname *.restartSplunkd\

Ciao.

Giuseppe

[ddrillic]

If you can @gcusello, it would be great.

[koshyk]

Please have a try using

| rest splunk_server=<yourdeploymentserver> /servicesNS/admin/<your_app>/configs/conf-inputs

If you are doing within the deployment-server, you can do splunk_server=local

[ddrillic]

No luck with that @koshyk. I get 0 results for it...

[koshyk]

hi mate, you sure you are on deployment-server (or the main server attached to deployment-server)?
In our case, we cannot do it from search heads, but only on the deployment server UI

[ddrillic]

Right, I'm on the deployment-server.

[koshyk]

Can you please try for an APP, which is part of default setting? Like "search" app or a generic app. just to ensure it is not permission related. ANY server should show it

[ddrillic]

@koshyk, sorry, trying a different route.

This one worked for sanity connection check -

curl -k -u user:passwrd https://<deployment server>:8089/services

Against the app -

$ curl -k -u user:passwrd https://<deployment server>:8089/servicesNS/admin/<deployment app>/configs/conf-inputs

<?xml version="1.0" encoding="UTF-8"?>
<response>
  <messages>
    <msg type="ERROR">Application does not exist: <deployment app></msg>
  </messages>
</response>

[koshyk]

@drillic, you shouldn't put <deployment app>. I've provided as a placeholder example. You need to put the actual name of your app

for eg. search app
| rest /servicesNS/admin/search/configs/conf-inputs

[ddrillic]

I did so @koshyk

[ddrillic]

I had a nice call with our SE, who concluded that the conventional rest calls don't cover the deployment server apps as they are not memory resident.

[ddrillic]

For the record, our SE said -

-- .. Just that the deployment server's interactions with the API is unique, as the API (as far as I could tell) is looking at the active configuration files (/apps), not the deployment configs.

I don't believe we have an existing endpoint to do what you want,...

[dstaulcu]

ive worked with windows garbage (propriety data stores for config files) most of my career and can finally use github and jenkins to great effect for my splunk configs. have you thought of automating at that level of abstraction?

[pruthvikrishnap]

not sure if this helps, https://docs.splunk.com/Documentation/Splunk/7.2.6/RESTREF/RESTinput