Splunk Search

Need help with Splunk REST command, Get property value from configuration file

somesoni2
Revered Legend

Hi All,

I am trying to write a search to get values from the configuration file. An example of it will be to the minFreeSpace property from server.conf (under diskUsage stanza).

So far I have written:

| rest /services/properties/server/diskUsage 

This gives me list of properties defined under diskUsage stanza, but value for each property is not shown.

"author" "id                                       "published"  "splunk_server"     "title"     "updated"
"blank" "<someurl>diskUsage/minFreeSpace"          "blank"      "myhost"         "minFreeSpace" "somedate"
"blank" "<someurl>diskUsage/pollingFrequency"      "blank"      "myhost"       "pollingFrequency"   "somedate"
"blank" "<someurl>diskUsage/pollingTimerFrequency" "blank"      "myhost"      "pollingTimerFrequency"   "somedate"

Could anyone help me how to get the values too.
I tried with "|REST /services/properties/server/diskUsage/minFreeSpace" but it shows no result.

Tags (2)
1 Solution

fervin
Path Finder

I opened a support ticket on a similar issue. Until the latest release (v6.0.2) the rest search command would not return text value elements included in the response. This behavior is now fixed.

View solution in original post

fervin
Path Finder

I opened a support ticket on a similar issue. Until the latest release (v6.0.2) the rest search command would not return text value elements included in the response. This behavior is now fixed.

somesoni2
Revered Legend

I was using Splunk 5.0.5 but planning to upgrade to Splunk 6.x. Thanks for the update.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I can't test this right now, but you might be trapped in namespace hell. Give it a shot to play around with the various servicesNS options.

Your second URL with the stanza and key should be the only properties endpoint to actually report a value, once namespace stuff is sorted out.

As an alternative, take a look at the configs/conf-server endpoint.

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...