Splunk Enterprise

Is there any script to lint and validate splunk config?

muebel
SplunkTrust
SplunkTrust

Do any of you use (or know of) any scripts that look at splunk configuration and point out errors, or otherwise allow for a framework to do some sanity checking? This is a fairly open question, and I'd also love any ideas for what kind of things you'd like to see in such a script.

Labels (2)
0 Karma
1 Solution

tscroggins
Influencer

@muebel 

btool includes a "check" command, which I believe does simple .conf.spec validation, similar to Splunk startup.

AppInspect includes various checks.

The official Visual Studio Code Extension for Splunk includes .conf linting. I've not used it, so I can't comment on its quality or accuracy.

How deep down the lint rabbit hole do you plan to go? It's perhaps too late to break PC-lint's continuously advertised software record. 😉 (I do miss Dr. Dobb's Journal.)

View solution in original post

VatsalJagani
SplunkTrust
SplunkTrust

@muebel - How about btool?

./splunk btool check

tscroggins
Influencer

@muebel 

btool includes a "check" command, which I believe does simple .conf.spec validation, similar to Splunk startup.

AppInspect includes various checks.

The official Visual Studio Code Extension for Splunk includes .conf linting. I've not used it, so I can't comment on its quality or accuracy.

How deep down the lint rabbit hole do you plan to go? It's perhaps too late to break PC-lint's continuously advertised software record. 😉 (I do miss Dr. Dobb's Journal.)

muebel
SplunkTrust
SplunkTrust

hmm it appears that check doesn't work when also using the --dir flag

0 Karma

muebel
SplunkTrust
SplunkTrust

with some help from @mmccul in slack I was able to figure this out.

btool is expecting a specific directory structure, and is looking for the spec files to be found in `system/README` from what is specified as the `--dir` target.

It also only looks in directories named like the normal config directories ( apps, master-apps etc)

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...