Security

how to load/save files under $Splunk\etc\users\USER_NAME\APP_NAME

William
Path Finder

i have extended a Splunk module, and in it i would like to load/save some data. moreover, i want to bind that data to both the user and the app. so, i think "$Splunk\etc\users\USER_NAME\APP_NAME" is a good place for this kind of files.

But how to do declare the path? and how to do this?

Tags (3)
0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

You should not modify files directly from your module. It's a better idea to use splunkd's REST API to modify files. Specifically, if you POST to https://server:port/servicesNS/<user>/<app>/admin/conf-<conf-file>;, you'll create entries in $SPLUNK_HOME/etc/users/<user>/<app>/local/<conf-file>.conf. You can create a stanza named foo with a line key=value by POSTing name=foo&key=value. You can read this stanza at servicesNS/<user>/<app>/admin/conf-<conf-file>/<stanza>.

Helpers for reading and writing from these can be found in entities.py which ships with Splunk.

Note that this method is not officially supported.

William
Path Finder

i've solved this problem by adding some python modules and modifying somewhere in the splunk needed. but its compatibility is bad.

I haven't tried your method. Maybe for the next time, i have to do things like this. Thanks anyway.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...