Splunk Search

Need help with Splunk REST command, Get property value from configuration file

somesoni2
SplunkTrust
SplunkTrust

Hi All,

I am trying to write a search to get values from the configuration file. An example of it will be to the minFreeSpace property from server.conf (under diskUsage stanza).

So far I have written:

| rest /services/properties/server/diskUsage 

This gives me list of properties defined under diskUsage stanza, but value for each property is not shown.

"author" "id                                       "published"  "splunk_server"     "title"     "updated"
"blank" "<someurl>diskUsage/minFreeSpace"          "blank"      "myhost"         "minFreeSpace" "somedate"
"blank" "<someurl>diskUsage/pollingFrequency"      "blank"      "myhost"       "pollingFrequency"   "somedate"
"blank" "<someurl>diskUsage/pollingTimerFrequency" "blank"      "myhost"      "pollingTimerFrequency"   "somedate"

Could anyone help me how to get the values too.
I tried with "|REST /services/properties/server/diskUsage/minFreeSpace" but it shows no result.

Tags (2)
1 Solution

fervin
Path Finder

I opened a support ticket on a similar issue. Until the latest release (v6.0.2) the rest search command would not return text value elements included in the response. This behavior is now fixed.

View solution in original post

fervin
Path Finder

I opened a support ticket on a similar issue. Until the latest release (v6.0.2) the rest search command would not return text value elements included in the response. This behavior is now fixed.

somesoni2
SplunkTrust
SplunkTrust

I was using Splunk 5.0.5 but planning to upgrade to Splunk 6.x. Thanks for the update.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I can't test this right now, but you might be trapped in namespace hell. Give it a shot to play around with the various servicesNS options.

Your second URL with the stanza and key should be the only properties endpoint to actually report a value, once namespace stuff is sorted out.

As an alternative, take a look at the configs/conf-server endpoint.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...