Getting Data In

Forwarder REST API: How can I get the list of files monitored by a deployment app on a forwarder?

dominiquevocat
Motivator

There is a endpoint on a forwarder which lists the monitors i.e. the files indexed
/servicesNS/nobody/_appname_/data/inputs/monitor/
however, this endpoint lists all files monitored and not only the ones by this app.

How can i get the files monitored by an app or the files only in the "search" app i.E. manually added by an administrator on the machine?

0 Karma
1 Solution

dominiquevocat
Motivator

One workarround is to filter by the desired string in the feed.entry.id

| rename feed.entry.id AS id | rename feed.entry.title AS title  | eval tmp=mvzip(title,id) | table tmp | mvexpand tmp | eval tmp=split(tmp,",")| eval file=mvindex(tmp,0) | eval id=mvindex(tmp,1) | search id="*myAppName*" | table file

Not so very nice but somewhat ok-ish

View solution in original post

0 Karma

dominiquevocat
Motivator

If anyone wants to do this, feel free to download the App TA-forwarderquery
https://splunkbase.splunk.com/app/2775/

ncsantucci
Path Finder

This is awesome. This should be built-in!

0 Karma

dominiquevocat
Motivator

glad you like it. open for suggestions @ncsantucci

0 Karma

dominiquevocat
Motivator

One workarround is to filter by the desired string in the feed.entry.id

| rename feed.entry.id AS id | rename feed.entry.title AS title  | eval tmp=mvzip(title,id) | table tmp | mvexpand tmp | eval tmp=split(tmp,",")| eval file=mvindex(tmp,0) | eval id=mvindex(tmp,1) | search id="*myAppName*" | table file

Not so very nice but somewhat ok-ish

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...