I need to restart splunk (or reload_ds) every Monday at 7:00AM, as new alerts and dashboards are being made in the files every week. I am tired of manually doing this every week, and was thinking of writing a program to do this for me. But before I do anything, I would like to ask, is there a quicker or easier way to restart splunk on a weekly basis? ... View more

I am trying to see if I could make a git repository in the Splunk files to have git realize when a dashboard has been changed or when an alert was made, however I keep on getting the following error: "Could not initialize a new repository. libgit2 returned: failed to make directory 'C:\Program Files\Splunk\etc\apps\APPNAME/.git': Access is denied." Is there a way to get a git repo in the Splunk files? If not, is there any other way to recognize when an app has been altered (i.e when a dashboard or alert was made/edited), distribute said app to different servers, and replace the already existing app with the edited one? (or at least some form of source control) NOTE: I have stopped Splunk and tried to create the file as Splunk was stopped, yet it didn't work. This is Splunk version 7.1.1. Thanks for the help, hunterpj ... View more

Is there an app that allows you to notice when a app has been altered in github (like from a webhook), and can clone the remote repo into a web environment? I have seen some answers around but haven't seen any that deal with a environment only accessible via URL. If there is an app that allows Splunk to notice this, that would be great. Thanks, hunterpj ... View more

I am using a search command to find the savedsearches.conf for an alert. I created a search which can list all of the parameters in the savedsearches.conf, however it merges both the default and local savedsearches.conf for that alert. the search I use is below: | rest splunk_server=local /servicesNS/-/-/configs/conf-savedsearches search="eai:acl.app=INSERT_APP_NAME" | search title="INSERT_ALERT_TITLE" | rename eai:acl.app as app, eai:acl.perms.read as read, eai:acl.sharing as sharing | fields - updated published id eai* | fields title author splunk_server app read sharing * | eval title="[".title."]" | foreach * [eval title=if("<>"="author" OR "<>"="splunk_server" OR "<>"="app" OR "<>"="read" OR "<>"="sharing" OR "<>"="title" OR '<>'="",title,mvappend(title,"<>"."="."\"".'<>'."\""))] | fields title author splunk_server app read sharing | search title=** Is there any way for me to only see the local portion of the savedsearches.conf? ... View more

I want to look at values in savedsearch.conf using the REST API, however a lot of blank columns show up! When I type in this search: | rest splunk_server=local /servicesNS/-/-/saved/searches/ The attached table happens, and I don't know how to get rid of the unnecessary columns. Note: There are more blank columns than these, and they do not all start with action. ... View more

I need to locate the savedsearches.conf on a Splunk web server i.e. I can only reach this Splunk instance with a URL. if there is an app that allows this to happen that would be great too. I essentially want to copy/paste these alerts from the online instance to another instance, however I can only obtain the saved search properties via job inspection, which isn't in the format I want. ... View more

I have been trying to see if there is a way one can look into the files of a remote Splunk Instance, so I may copy the alerts from savedsearches.conf. I can easily copy the source XML for the dashboards i wish to copy, but is there any kind of source code for alerts? I know I could open and copy the search, but that's not what I want. ... View more