### Splunk Enterprise Instance Configuration Example Source: https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/9.0/welcome-to-splunk-enterprise-administration/configuration-file-reference/9.0.5-configuration-file-reference/instance.cfg This is an example of the instance.cfg file, which is part of the Splunk Enterprise installation. It should not be modified by users. The example shows the general section with a GUID. ```ini # Version 9.0.5 # # This file contains an example SPLUNK_HOME/etc/instance.cfg file; the # instance.cfg file is not to be modified or removed by user. LEAVE THE # instance.cfg FILE ALONE. # [general] guid = B58A86D9-DF3D-4BF8-A426-DB85C231B699 ``` -------------------------------- ### Example instance.cfg File Source: https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/configuration-file-reference/10.2.1-configuration-file-reference/instance.cfg.conf This is an example of the instance.cfg file. It includes comments explaining its purpose and a sample GUID. Do not modify this file. ```ini # Version 10.2.1 # # This file contains an example SPLUNK_HOME/etc/instance.cfg file; the # instance.cfg file is not to be modified or removed by user. LEAVE THE # instance.cfg FILE ALONE. # [general] guid = B58A86D9-DF3D-4BF8-A426-DB85C231B699 ``` -------------------------------- ### Example instance.cfg File Source: https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/9.1/configuration-file-reference/9.1.1-configuration-file-reference/instance.cfg.conf This is an example of the instance.cfg file. It includes version information and a sample GUID. Do not modify this file. ```cfg # Version 9.1.1 # # This file contains an example SPLUNK_HOME/etc/instance.cfg file; the # instance.cfg file is not to be modified or removed by user. LEAVE THE # instance.cfg FILE ALONE. # [general] guid = B58A86D9-DF3D-4BF8-A426-DB85C231B699 ``` -------------------------------- ### List Installed Applications Source: https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-user-manual/10.0/rest-api-user-manual/basic-concepts-about-the-splunk-platform-rest-api This example shows how to retrieve a list of applications installed on the Splunk server using a GET request to the /services/apps/local endpoint. ```APIDOC ## GET /services/apps/local ### Description Retrieves a list of applications installed on the Splunk server. ### Method GET ### Endpoint /services/apps/local ### Response #### Success Response (200) - **applications** (array) - A list of installed applications. ``` -------------------------------- ### Example app.conf Configuration Source: https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/9.2/configuration-file-reference/9.2.8-configuration-file-reference/app.conf This example shows how to configure basic application properties like author, description, and version within the [launcher] stanza. It also demonstrates setting up reload triggers for custom configuration files. ```ini # Version 9.2.8 # # The following are example app.conf configurations. Configure properties for # your custom application. # # There is NO DEFAULT app.conf. # # To use one or more of these configurations, copy the configuration block into # app.conf in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to # enable configurations. # # To learn more about configuration files (including precedence) please see the # documentation located at # http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles [launcher] author= description= version= [triggers] ########## Conf-level reload triggers ########## # Do not force a restart of Splunk Enterprise for state changes of MyApp # Do not run special code to tell MyApp to reload myconffile.conf # Apps with custom config files usually pick this option: reload.myconffile = simple # Do not force a restart of Splunk Enterprise for state changes of MyApp. # Splunk Enterprise calls the /admin/myendpoint/_reload method in my custom # EAI handler. # Use this advanced option only if MyApp requires custom code to reload # its configuration when its state changes reload.myotherconffile = access_endpoints /admin/myendpoint ########## Stanza-level reload triggers ########## # For any changed inputs.conf stanzas in the newly pushed cluster # bundle that start with the "monitor" stanza prefix, e.g. # [monitor://*], invoke the corresponding monitor input reload handler # as specified, i.e. /data/inputs/monitor/_reload # # NOTE: The scripted input reload handler and the http input reload # will NOT be invoked if the only changed inputs stanzas in the # newly pushed cluster bundle are monitor inputs. reload.inputs.monitor = access_endpoints /data/inputs/monitor reload.inputs.script = access_endpoints /data/inputs/script reload.inputs.http = access_endpoints /data/inputs/http ``` -------------------------------- ### Access Local Applications Source: https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-user-manual/9.2/rest-api-user-manual/basic-concepts-about-the-splunk-platform-rest-api This example shows how to retrieve a list of applications installed on the Splunk server using a GET request. ```APIDOC ## GET /services/apps/local ### Description Retrieves a list of applications installed on the Splunk server. ### Method GET ### Endpoint /services/apps/local ### Response #### Success Response (200) Returns a list of local applications. ``` -------------------------------- ### Get metadata for hosts across multiple indexes Source: https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/10.2/search-commands/metadata This example demonstrates how to retrieve metadata for hosts, filtering results to include only those from indexes that start with 'cs', 'na', 'ap', or 'eu'. ```splunk | metadata type=hosts index=cs* index=na* index=ap* index=eu* ``` -------------------------------- ### Example instance.cfg Configuration Source: https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/9.0/welcome-to-splunk-enterprise-administration/configuration-file-reference/9.0.0-configuration-file-reference/instance.cfg This snippet shows an example of the instance.cfg file, including comments explaining its purpose and a sample GUID. Do not modify this file. ```ini # Version 9.0.0 # # This file contains an example SPLUNK_HOME/etc/instance.cfg file; the # instance.cfg file is not to be modified or removed by user. LEAVE THE # instance.cfg FILE ALONE. # [general] guid = B58A86D9-DF3D-4BF8-A426-DB85C231B699 ``` -------------------------------- ### Example instance.cfg File Source: https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.0/configuration-file-reference/10.0.2-configuration-file-reference/instance.cfg.conf This is an example of the instance.cfg file. Do not modify or remove this file. ```ini # Version 10.0.2 # # This file contains an example SPLUNK_HOME/etc/instance.cfg file; the # instance.cfg file is not to be modified or removed by user. LEAVE THE # instance.cfg FILE ALONE. # [general] guid = B58A86D9-DF3D-4BF8-A426-DB85C231B699 ``` -------------------------------- ### Getting Started Source: https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/10.4/application-endpoints/application-endpoint-descriptions This endpoint provides access to 'Getting Started' resources or configurations. ```APIDOC ## GET /servicesNS/nobody/system/apps/local/gettingstarted ### Description Accesses 'Getting Started' information or configurations. ### Method GET ### Endpoint /servicesNS/nobody/system/apps/local/gettingstarted ``` -------------------------------- ### Count events in internal indexes with size Source: https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/10.2/search-commands/eventcount Use `summarize=false` to get individual event counts and `report_size=true` to include the index size in bytes. This example filters for all internal indexes starting with `_*`. ```splunk | eventcount summarize=false index=_* report_size=true ``` -------------------------------- ### Example pubsub.conf Configuration Source: https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/9.4/configuration-file-reference/9.4.2-configuration-file-reference/pubsub.conf An example pubsub.conf file demonstrating configurations for a Deployment Server and an internal broker using direct connection. ```ini # Version 9.4.2 [pubsub-server:deploymentServer] disabled=false targetUri=somehost:8089 [pubsub-server:internalbroker] disabled=false targetUri=direct ``` -------------------------------- ### Example GET Request for /services/pura_remote_result Source: https://help.splunk.com/en/splunk-enterprise/administer/upgrade-readiness-app/10.0/check-upgrade-readiness/rest-api-reference-for-the-upgrade-readiness-app Example of how to make a GET request to the /services/pura_remote_result endpoint using curl. ```curl curl -k -u username:password https://localhost:8089/services/pura_remote_result -X GET ```