Splunk Search

Is there a way to write a splunk query which displays our props.conf , transform.conf , indexes.conf configuarion as outputs

nasamajh09
New Member

I would like to see in props.conf how data parsing is done

My query should return results stating

sourcetype TIME_FORMAT LINE_BREAKER TIME_PREFIX etc

Tags (1)
0 Karma

adonio
Ultra Champion

hi nasamajh09,
here is a rest query that brings all props data: | rest /services/configs/conf-props
now you can filter, for example: | table title eai:appName eai:userName eai:acl.sharing TIME_FORMAT LINE_BREAKER TIME_PREFIX

hope it helps

0 Karma

adonio
Ultra Champion

also, same goes for indexes and transforms so:
| rest /services/configs/conf-indexes
| rest /services/configs/conf-transforms
and then filter however you like

0 Karma
Get Updates on the Splunk Community!

Fall Into Learning with New Splunk Education Courses

Every month, Splunk Education releases new courses to help you branch out, strengthen your data science roots, ...

Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...

By Martin Hettervik, Senior Consultant and Team Leader at Accelerate at Iver, Splunk MVPThe stats command is ...

How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes

Your bank's payment processing system is humming along during a busy afternoon, handling millions in hourly ...