Splunk Search

How can I retrieve a value from local .conf file and use in splunk query

ektasiwani
Communicator

Hi,

I have a file in local directory with name myconf.conf .
This file is create by setup form filled by user.
I want to know how can to use this values in splunk query.
Myconf.conf file contain data abount customer name and email and index.
this is what is stored in .conf file

[customerinfo]
custname = eku
custemail = eku@gmail.com
indexmain = main

My requirement is to use this value in search like
indexmain | stats count by custname

Any help is appreciated.

Thanks

Tags (2)
0 Karma
1 Solution

bmacias84
Champion

Hello @ektasiwani,

You can use the rest api to return configurations in Splunk. This works well for Splunk defined or Modular input conf files.

Using configs:

| rest  /services/configs/conf-authorize
OR
| rest  /services/configs/conf-<file>

Using properties endpoint:

| rest  /services/properties/authorize
OR
| rest  /services/properties/<conf_file>

Cheers,

View solution in original post

bmacias84
Champion

Hello @ektasiwani,

You can use the rest api to return configurations in Splunk. This works well for Splunk defined or Modular input conf files.

Using configs:

| rest  /services/configs/conf-authorize
OR
| rest  /services/configs/conf-<file>

Using properties endpoint:

| rest  /services/properties/authorize
OR
| rest  /services/properties/<conf_file>

Cheers,

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...