Splunk Search

Verifying Configuration Through Splunk Web

michaeloleary
Path Finder

Hi Folks,

I'm trying to see if I can verify the configuration of any deployment applications via Splunk web. Currently administrators are making changes to a deployment application but the change is not visible to the users of Splunk when integrating new devices/syslogs etc. For instance if I change the following file.

/opt/splunk/etc/deployment-apps/test-app/local/inputs.conf

Users will not be able to see the change without SSH-ing into the deployment server and cat-ing the configuration file manually, I'd like to avoid giving users cli access where possible. Currently users in the organisation are unable to verify the configuration of the inputs.conf. I know in S.O.S, Splunk uses btool to verify the configuration of the inputs files under the apps directory. Is there something similar that can do the job described above with the deployment apps? Maybe btool can achieve this but I've had very little luck at the moment. Any help would be greatly appreciated. Thanks folks.

Tags (1)
0 Karma

MuS
SplunkTrust
SplunkTrust

hi michaeloleary

you could use the same btool from S.o.S. for this, it is a python script in etc/apps/sos/bin/ called btool.py. Copy it to etc/apps/<yourapp>/bin and add btool.py to commands.conf in etc/apps/<yourapp>/default/.

After that you can run the following query to get the inputs on your splunk:

 | btool inputs 

hope this helps

cheers,

MuS

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...