Splunk Enterprise

Help to list the .conf files from conf objects

PraveenaR
Explorer

I need to get the list of .conf files.

On running my below Splunk Query,

"| rest /services/configs/conf-props"

it returns the conf objects, but I need to find the .conf files instead of objects.

Any help would be appreciated!

Thanks!

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try | rest /servicesNS/-/-/properties

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try | rest /servicesNS/-/-/properties

---
If this reply helps you, an upvote would be appreciated.

PraveenaR
Explorer

@richgalloway ,

In similar way I need to list all the macros as files instead of config objects.

Any help would be appreciated.

Thanks!

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

I think that you can found answers from this conf presentation:

r. Ismo

PraveenaR
Explorer

@richgalloway ,

The query you mentioned helps to display the properties as config objects, but not as files.

My use case is to list as files from the config objects listed.

Any help on this would be appreciated.

Thanks!

0 Karma

PraveenaR
Explorer

Thanks for quick response!

I need to display both config files and views in a single query.

My Below queries work fine if I run seperately,

Queries:

1.     | rest splunk_server=local /servicesNS/-/-/data/ui/views
         | table eai:acl.sharing eai:acl.owner id
         | rename eai:acl.owner as owner, eai:acl.sharing AS sharing

2.     | rest /servicesNS/-/-/properties

My use case is to display both config files and views together with updated time.

Any help would be appreciated!

Thanks!

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The challenge is finding common field values between the two queries so you can merge their results.

| rest splunk_server=local /servicesNS/-/-/data/ui/views
| table eai:acl.sharing eai:acl.owner id
| rename eai:acl.owner as owner, eai:acl.sharing AS sharing
| append [| rest /servicesNS/-/-/properties ]
| stats values(*) as * by <<some shared field name(s)>>

BTW, Splunk rarely updates the Updated field so I wouldn't try to use it for anything.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...