Verifying Configuration Through Splunk Web

[michaeloleary]

Hi Folks,

I'm trying to see if I can verify the configuration of any deployment applications via Splunk web. Currently administrators are making changes to a deployment application but the change is not visible to the users of Splunk when integrating new devices/syslogs etc. For instance if I change the following file.

/opt/splunk/etc/deployment-apps/test-app/local/inputs.conf

Users will not be able to see the change without SSH-ing into the deployment server and cat-ing the configuration file manually, I'd like to avoid giving users cli access where possible. Currently users in the organisation are unable to verify the configuration of the inputs.conf. I know in S.O.S, Splunk uses btool to verify the configuration of the inputs files under the apps directory. Is there something similar that can do the job described above with the deployment apps? Maybe btool can achieve this but I've had very little luck at the moment. Any help would be greatly appreciated. Thanks folks.

[MuS]

hi michaeloleary

you could use the same btool from S.o.S. for this, it is a python script in etc/apps/sos/bin/ called btool.py. Copy it to etc/apps/<yourapp>/bin and add btool.py to commands.conf in etc/apps/<yourapp>/default/.

After that you can run the following query to get the inputs on your splunk:

 | btool inputs 

hope this helps

cheers,

MuS