Splunk Search

How can I retrieve a value from local .conf file and use it inside a python script lookup?

RiccardoV
Communicator

Hi guys,

I have a value inside a local personalized .conf file (/Splunk/etc/apps/$app/local), ie:

[stanza-name]
value-name = value

How can I retrieve this value and use it inside a python lookup script (stored in /Splunk/etc/apps/$app/bin)?

thanks,

0 Karma
1 Solution

RiccardoV
Communicator

I find the answer looking into the google-maps splunk plugin.
I recycle and modify a little that function:

import os
import sys
from splunk.clilib import cli_common as cli

def getSelfConfStanza(stanza):
    appdir = os.path.dirname(os.path.dirname(__file__))
    apikeyconfpath = os.path.join(appdir, "default", "file.conf")
    apikeyconf = cli.readConfFile(apikeyconfpath)
    localconfpath = os.path.join(appdir, "local", "file.conf")
    if os.path.exists(localconfpath):
        localconf = cli.readConfFile(localconfpath)
        for name, content in localconf.items():
            if name in apikeyconf:
                apikeyconf[name].update(content)
            else:
                apikeyconf[name] = content
return apikeyconf[stanza]

Now you can access your configuration:

stanza = getSelfConfStanza("yourStanzaName")
value = stanza['yourValueKey']

View solution in original post

RiccardoV
Communicator

I find the answer looking into the google-maps splunk plugin.
I recycle and modify a little that function:

import os
import sys
from splunk.clilib import cli_common as cli

def getSelfConfStanza(stanza):
    appdir = os.path.dirname(os.path.dirname(__file__))
    apikeyconfpath = os.path.join(appdir, "default", "file.conf")
    apikeyconf = cli.readConfFile(apikeyconfpath)
    localconfpath = os.path.join(appdir, "local", "file.conf")
    if os.path.exists(localconfpath):
        localconf = cli.readConfFile(localconfpath)
        for name, content in localconf.items():
            if name in apikeyconf:
                apikeyconf[name].update(content)
            else:
                apikeyconf[name] = content
return apikeyconf[stanza]

Now you can access your configuration:

stanza = getSelfConfStanza("yourStanzaName")
value = stanza['yourValueKey']

Snehalg176
Loves-to-Learn Everything

Hi @RiccardoV ,

Is there any documentation on library "splunk.clilib" or on module "cli_common" ? Also, can you please let me know if there is any method to write contents to the config file that we are reading through command line ?

0 Karma

SanjayReddy
SplunkTrust
SplunkTrust


Hi  @Snehalg176 

I’m a Community Moderator in the Splunk Community. Thanks for contributing as a member in the forum!

This question was posted 10 years ago and might not get the attention you need for your own question to be answered. I suggest you please post a brand new question so your issue can get more visibility. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...