Splunk Search

Verifying Configuration Through Splunk Web

michaeloleary
Path Finder

Hi Folks,

I'm trying to see if I can verify the configuration of any deployment applications via Splunk web. Currently administrators are making changes to a deployment application but the change is not visible to the users of Splunk when integrating new devices/syslogs etc. For instance if I change the following file.

/opt/splunk/etc/deployment-apps/test-app/local/inputs.conf

Users will not be able to see the change without SSH-ing into the deployment server and cat-ing the configuration file manually, I'd like to avoid giving users cli access where possible. Currently users in the organisation are unable to verify the configuration of the inputs.conf. I know in S.O.S, Splunk uses btool to verify the configuration of the inputs files under the apps directory. Is there something similar that can do the job described above with the deployment apps? Maybe btool can achieve this but I've had very little luck at the moment. Any help would be greatly appreciated. Thanks folks.

Tags (1)
0 Karma

MuS
Legend

hi michaeloleary

you could use the same btool from S.o.S. for this, it is a python script in etc/apps/sos/bin/ called btool.py. Copy it to etc/apps/<yourapp>/bin and add btool.py to commands.conf in etc/apps/<yourapp>/default/.

After that you can run the following query to get the inputs on your splunk:

 | btool inputs 

hope this helps

cheers,

MuS

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...