ksconf attr-get

Get a specific stanza and attribute value from a Splunk .conf file.

usage: ksconf attr-get [-h] --stanza STANZA --attribute ATTR [--missing-okay]
                       [-o OUTPUT]
                       conf [conf ...]

Positional Arguments


Input file or standard input.

Named Arguments

--stanza, -s

Name of the stanza within CONF to retrieve.

--attribute, --attr, -a

Name of attribute within STANZA to retrieve.


Ignore missing stanzas and attributes.

-o, --output

File where the filtered results are written. Defaults to standard out.


Show the version of the Splunk AWS technology addon:

ksconf attr-get etc/apps/Splunk_TA_AWS/default/app.conf --stanza launcher --attribute version

Fetch the search string for the “Internal Server Errors” search in the from my_app. The search is saved to a text file without any metadata or line continuation markers (trailing \ characters.) Note that kconf merge is used here to ensure that the “live” version of the search is shown, so local will be used if present, otherwise default will be shown.

ksconf merge $SPLUNK_HOME/etc/apps/my_app/{default,local}/savedsearches.conf \
| ksconf attr-get - -s "Internal System Errors" -a search -o errors_search.txt