Splunk Search

Is there a way to write a splunk query which displays our props.conf , transform.conf , indexes.conf configuarion as outputs

nasamajh09
New Member

I would like to see in props.conf how data parsing is done

My query should return results stating

sourcetype TIME_FORMAT LINE_BREAKER TIME_PREFIX etc

Tags (1)
0 Karma

adonio
Ultra Champion

hi nasamajh09,
here is a rest query that brings all props data: | rest /services/configs/conf-props
now you can filter, for example: | table title eai:appName eai:userName eai:acl.sharing TIME_FORMAT LINE_BREAKER TIME_PREFIX

hope it helps

0 Karma

adonio
Ultra Champion

also, same goes for indexes and transforms so:
| rest /services/configs/conf-indexes
| rest /services/configs/conf-transforms
and then filter however you like

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...