How to Edit inputs.conf Using Splunk API?

[AstinSebastian]

Hi Splunk Community,

I am looking to edit the inputs.conf file programmatically via the Splunk API. Specifically, I want to know:

Is there an API endpoint available to update the inputs.conf file?
If yes, what would be the correct method to achieve this (e.g., required endpoint, parameters, or payload)?

I understand that inputs.conf primarily configures data inputs, and certain operations might have to be performed via the REST API or directly through configuration file updates. Any documentation or examples regarding:

Supported Splunk API endpoints for modifying input configurations.
Best practices for editing inputs.conf programmatically.
Any necessary permissions or prerequisites to perform such updates.

[isoutamo]

Hi

I cannot recall that there are this kind of api at least supported by Splunk.

Of course you can do it by yourself if you really want, but probably there is a better way to do what you are aiming for?

So what is the issue which you are trying to solve?

r. Ismo

[AstinSebastian]

Hi Ismo,

I am working on developing an app that updates the values in the inputs.conf file from the setup.xml configuration. Additionally, the app retrieves values from the inputs.conf file and loads them into Splunk.

[isoutamo]

You probably have looked this https://dev.splunk.com/enterprise/tutorials/module_setuppages/plansetup ?

One place where you could look help is CIM app. Another one is TA for *nix where are modified those inputs values on setup screen.