Manipulate conf file through Splunk/Rest API

[klausJohan]

Hi,

Is there any experience around to be shared concerning how to programmatically manipulate (read, update) through Splunk API or REST API a custom conf file (say "myapp.conf").

Cheers

[sowings · Accepted solution]

I'd start with trying the | rest search command in Splunk. It would at least tell you if your custom config file is reachable by the REST endpoint. Try: | rest /services/configs/conf-myapp (or optionally, constrain the app and user: | rest /servicesNS/admin/myapp/configs/conf-myapp).

Note that any POSTs to define settings don't have restrictions on the keys, that's up to your app to define. More docs about the POST (and an example) can be found here:

http://docs.splunk.com/Documentation/Splunk/6.0/RESTAPI/RESTconfig

[klausJohan]

Eventually it worked with curl also.

[sowings]

How did you issue the curl call?

I created a new config 'myconfig' and a corresponding 'myconfig.conf.spec' in the README subdir of my app. After that, I was able to

curl -k -u admin:pass https://127.0.0.1:8089/servicesNS/admin/fire_brigade/configs/conf-myconfig

I only mention the README subdir because I didn't try it without. Did you get an error from the curl call? I got an XML response that contained the config key. Note also that I restarted Splunk after adding the config file and the README/myconfig.conf.spec. I'm not sure if that was required, but....

[klausJohan]

Yes, through "| rest ..." I can see my conf file. But the get/post request with curl or from the browser return no result