Splunk Search

Is there a way to write a splunk query which displays our props.conf , transform.conf , indexes.conf configuarion as outputs

nasamajh09
New Member

I would like to see in props.conf how data parsing is done

My query should return results stating

sourcetype TIME_FORMAT LINE_BREAKER TIME_PREFIX etc

Tags (1)
0 Karma

adonio
Ultra Champion

hi nasamajh09,
here is a rest query that brings all props data: | rest /services/configs/conf-props
now you can filter, for example: | table title eai:appName eai:userName eai:acl.sharing TIME_FORMAT LINE_BREAKER TIME_PREFIX

hope it helps

0 Karma

adonio
Ultra Champion

also, same goes for indexes and transforms so:
| rest /services/configs/conf-indexes
| rest /services/configs/conf-transforms
and then filter however you like

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...