Getting Data In

Can you make .conf changes with the rest API?

Log_wrangler
Builder

Has anyone used the rest API to successfully edit a conf file?

I understand there are 3 methods GET, POST, DELETE.
I understand one can manipulate searches but I am unfamiliar with managing objects and configurations with the API.

Any advice or examples would be awesome.

Thank you

Tags (3)
0 Karma
1 Solution

renjith_nair
Legend

@Log_wrangler,

You can edit conf with rest API

For e.g.

curl -k -u admin:pass https://localhost:8089/servicesNS/nobody/search/configs/conf-props \
    -d name=myweblogs \
    -d CHARSET=UTF-8 \
    -d SHOULD_LINEMERGE=false

In the above, if the stanza myweblogs does not exist, then it creates a new one and if it exists, it updates it with the value you provided.

Detailed documentation is available in http://docs.splunk.com/Documentation/Splunk/latest/RESTTUT/RESTconfigurations

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@Log_wrangler,

You can edit conf with rest API

For e.g.

curl -k -u admin:pass https://localhost:8089/servicesNS/nobody/search/configs/conf-props \
    -d name=myweblogs \
    -d CHARSET=UTF-8 \
    -d SHOULD_LINEMERGE=false

In the above, if the stanza myweblogs does not exist, then it creates a new one and if it exists, it updates it with the value you provided.

Detailed documentation is available in http://docs.splunk.com/Documentation/Splunk/latest/RESTTUT/RESTconfigurations

---
What goes around comes around. If it helps, hit it with Karma 🙂

serjandrosov
Path Finder
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...