Splunk Search

How can I retrieve a value from local .conf file and use in splunk query

ektasiwani
Communicator

Hi,

I have a file in local directory with name myconf.conf .
This file is create by setup form filled by user.
I want to know how can to use this values in splunk query.
Myconf.conf file contain data abount customer name and email and index.
this is what is stored in .conf file

[customerinfo]
custname = eku
custemail = eku@gmail.com
indexmain = main

My requirement is to use this value in search like
indexmain | stats count by custname

Any help is appreciated.

Thanks

Tags (2)
0 Karma
1 Solution

bmacias84
Champion

Hello @ektasiwani,

You can use the rest api to return configurations in Splunk. This works well for Splunk defined or Modular input conf files.

Using configs:

| rest  /services/configs/conf-authorize
OR
| rest  /services/configs/conf-<file>

Using properties endpoint:

| rest  /services/properties/authorize
OR
| rest  /services/properties/<conf_file>

Cheers,

View solution in original post

bmacias84
Champion

Hello @ektasiwani,

You can use the rest api to return configurations in Splunk. This works well for Splunk defined or Modular input conf files.

Using configs:

| rest  /services/configs/conf-authorize
OR
| rest  /services/configs/conf-<file>

Using properties endpoint:

| rest  /services/properties/authorize
OR
| rest  /services/properties/<conf_file>

Cheers,

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...