Splunk Search

Is there a way to write a splunk query which displays our props.conf , transform.conf , indexes.conf configuarion as outputs

nasamajh09
New Member

I would like to see in props.conf how data parsing is done

My query should return results stating

sourcetype TIME_FORMAT LINE_BREAKER TIME_PREFIX etc

Tags (1)
0 Karma

adonio
Ultra Champion

hi nasamajh09,
here is a rest query that brings all props data: | rest /services/configs/conf-props
now you can filter, for example: | table title eai:appName eai:userName eai:acl.sharing TIME_FORMAT LINE_BREAKER TIME_PREFIX

hope it helps

0 Karma

adonio
Ultra Champion

also, same goes for indexes and transforms so:
| rest /services/configs/conf-indexes
| rest /services/configs/conf-transforms
and then filter however you like

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...