Splunk Search

Splunk Config Files Location

mnestaz
Engager

Hi everyone, 

We are currently looking a config file(s) that consist of the details below, instead of running executables. Running the executables require privileged access, which we are trying to limit. Are there any config files that we can check that has the outputs below.  If yes, please share the relevant config files details.

#./splunk display listen

#./splunk show deploy-poll

#./splunk list forward-server

#./splunk show servername

#./splunk show default-hostname

# /opt/splunkforwarder/bin/splunk list monitor

# /opt/splunkforwarder/bin/splunk version

 

Thank you. Cheers.
Nestaz

Labels (1)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mnestaz,

All the config files are in the etc folder, anyway the files you're serching are these:

#./splunk display listen                                                    ???

#./splunk show deploy-poll                                            $SPLUNK_HOME/etc/system/local/deploymentclient.conf

#./splunk list forward-server                                         $SPLUNK_HOME/etc/system/local/serverclass.conf

#./splunk show servername                                          $SPLUNK_HOME/etc/system/local/server.conf

#./splunk show default-hostname                              $SPLUNK_HOME/etc/system/local/server.conf

# /opt/splunkforwarder/bin/splunk list monitor  ???

# /opt/splunkforwarder/bin/splunk version          $SPLUNK_HOME/etc/splunk.version

Ciao.

Giuseppe

venkatasri
SplunkTrust
SplunkTrust

@mnestaz Following details might help. An upvote would be appreciated if it helps!

#./splunk display listen   

$SPLUNK_HOME/etc/system/local (or) default/ $SPLUNK_HOME/etc/apps/<app_name>/local or default/

Look for inputs.conf find keyword - [splunktcp:

# /opt/splunkforwarder/bin/splunk list monitor  

$SPLUNK_HOME/etc/system/local (or) default/ $SPLUNK_HOME/etc/apps/<app_name>/local or default/

Look for inputs.conf find keyword - [monitor:

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...