Security

how to load/save files under $Splunk\etc\users\USER_NAME\APP_NAME

William
Path Finder

i have extended a Splunk module, and in it i would like to load/save some data. moreover, i want to bind that data to both the user and the app. so, i think "$Splunk\etc\users\USER_NAME\APP_NAME" is a good place for this kind of files.

But how to do declare the path? and how to do this?

Tags (3)
0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

You should not modify files directly from your module. It's a better idea to use splunkd's REST API to modify files. Specifically, if you POST to https://server:port/servicesNS/<user>/<app>/admin/conf-<conf-file>;, you'll create entries in $SPLUNK_HOME/etc/users/<user>/<app>/local/<conf-file>.conf. You can create a stanza named foo with a line key=value by POSTing name=foo&key=value. You can read this stanza at servicesNS/<user>/<app>/admin/conf-<conf-file>/<stanza>.

Helpers for reading and writing from these can be found in entities.py which ships with Splunk.

Note that this method is not officially supported.

William
Path Finder

i've solved this problem by adding some python modules and modifying somewhere in the splunk needed. but its compatibility is bad.

I haven't tried your method. Maybe for the next time, i have to do things like this. Thanks anyway.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...