Introducing Config Quest for Splunk!
We are pleased to announce the release of our latest Splunk certified app, Config Quest for Splunk.
Config Quest is an awesome lightweight utility from Discovered Intelligence for searching and reviewing Splunk configurations on any Splunk server directly from your search head! Use Config Quest to search for any stanza or configuration parameter, in any selected app, across any Splunk server in your environment.
At the heart of the app is a powerful dashboard; enabling searching of Splunk configurations by conf file, host, app, stanza and/or parameter. The configurations returned are nicely formatted into the familiar stanza, parameter and value Splunk conf file format, along with text based highlighting to aid visualization and readability.
Simply install on a Search Head and you are good to go. There are no scripts to run or deploy across your environment.
Why is this app useful?
You can use Config Quest to:
- Instantly search for Splunk configurations across any Splunk server in your environment from one place
- Search for configurations by host, wildcard host, conf file, app, stanza and/or parameter
- Centrally review your serverclass.conf and view the serverclasses and apps, along with the deployment clients that have been assigned the serverclasses
The app leverages Splunk’s REST based commands, then uses complex formatting and logic to present the data in a familiar Splunk Conf file format by stanza, parameter and value.
Why not just use btool?
Config Quest does not replace btool, but instead provides a convenient mechanism to remotely review configurations residing on your Splunk servers, without the need to log into the host and run btool or check files manually. There are no scripts to run, no complex logic to learn and nothing to install other than this app on your Search Head. While btool rolls up configurations using Splunk’s inheritance based rules, the configs returned by Config Quest are in their raw state prior to rollup, although some defaults are picked up in the results.
Are there dashboards/reports?
Yes, there are currently two dashboards:
- Current Config Quest – allows for centralized searching and reviewing configurations across all your Splunk servers
- Serverclass Config Quest – allows for remote interrogation of your Serverclass.conf, presenting a similar view to the deployment server and lists all serverclasses, apps and the deployment clients associated with the various serverclasses
Future Releases
We are continuously improving our Splunk apps and the following items are planned for a future release. Let us know if you would like us to add something!
- Historic conf file analysis – the ability to archive configurations and then reference old configurations and compare against current configurations
- Host or conf files comparison – ability to compare the configs on one host against another host and easily identify differences
For support, to request feature enhancements or simply to give us your feedback – please contact us at support@discoveredintelligence.ca
Looking to expedite your success with Splunk? Click here to view our Splunk service offerings.
© Discovered Intelligence Inc., 2017. Unauthorised use and/or duplication of this material without express and written permission from this site’s owner is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to Discovered Intelligence, with appropriate and specific direction (i.e. a linked URL) to this original content.
