Splunk Search

Need help with Splunk REST command, Get property value from configuration file

somesoni2
Revered Legend

Hi All,

I am trying to write a search to get values from the configuration file. An example of it will be to the minFreeSpace property from server.conf (under diskUsage stanza).

So far I have written:

| rest /services/properties/server/diskUsage 

This gives me list of properties defined under diskUsage stanza, but value for each property is not shown.

"author" "id                                       "published"  "splunk_server"     "title"     "updated"
"blank" "<someurl>diskUsage/minFreeSpace"          "blank"      "myhost"         "minFreeSpace" "somedate"
"blank" "<someurl>diskUsage/pollingFrequency"      "blank"      "myhost"       "pollingFrequency"   "somedate"
"blank" "<someurl>diskUsage/pollingTimerFrequency" "blank"      "myhost"      "pollingTimerFrequency"   "somedate"

Could anyone help me how to get the values too.
I tried with "|REST /services/properties/server/diskUsage/minFreeSpace" but it shows no result.

Tags (2)
1 Solution

fervin
Path Finder

I opened a support ticket on a similar issue. Until the latest release (v6.0.2) the rest search command would not return text value elements included in the response. This behavior is now fixed.

View solution in original post

fervin
Path Finder

I opened a support ticket on a similar issue. Until the latest release (v6.0.2) the rest search command would not return text value elements included in the response. This behavior is now fixed.

somesoni2
Revered Legend

I was using Splunk 5.0.5 but planning to upgrade to Splunk 6.x. Thanks for the update.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I can't test this right now, but you might be trapped in namespace hell. Give it a shot to play around with the various servicesNS options.

Your second URL with the stanza and key should be the only properties endpoint to actually report a value, once namespace stuff is sorted out.

As an alternative, take a look at the configs/conf-server endpoint.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...