Modify log.cfg via rest

tlmayes · ‎08-02-2017

Is it possible to modify log.cfg via REST? We have several thousand UF's where we need to modify this config file.

hardikJsheth · ‎08-03-2017

Are you using deployment server for managing your Universal Forwarders?

tlmayes · ‎08-03-2017

Yes, but the requirement here is to use REST. A onetime "permanent" change without adding to the very long list of "apps" to maintain. Unless I am mistaken, once we make the change via a Deployment Svr app, we can never remove the app since that would also remove the change.

Modify log.cfg via rest

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

Best Practices: Splunk auto adjust pipeline queue

Join the Conversation

Modify log.cfg via rest

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

Best Practices: Splunk auto adjust pipeline queue