Ksconf Splunk CONFiguration tool

This utility handles a number of common Splunk app maintenance tasks in an installable python package. Specifically, this tools deals with many of the nuances of storing Splunk apps in a version control system like git and pointing live Splunk apps to a working tree. Merging changes from the live system's (local) folder to the version controlled (default) folder and dealing with more than one layer of "default" are all supported tasks which are not native to Splunk.

Install

Splunk:

1. Download and install KSCONF App for Splunk
2. Run the command: splunk cmd python3 $SPLUNK_HOME/etc/apps/ksconf/bin/install.py

Python:

pip install ksconf

Confirm installation with the following command:

ksconf --help

Resources

Docs:

• Official docs hosted via ReadTheDocs.io
• Command line reference
• Installation docs
• Change log

Need help?

• Ask questions on GitHub or Splunk Answers
• Chat about #ksconf on Splunk's Slack channel

Get involved:

• Report bugs
• Review known bugs
• Request new features
• Contribute code

Presentations:

• About ksconf:

  • The joys and pitfalls of managing your Splunk deployment with Git Philly Splunk Meetup - June 6, 2018
  • Managing Splunk Deployments With Git and KSCONF (slides) Splunk .conf bsides talk - Oct 2, 2018

• Honorable mentions:

  • DEV1132B - How To Become the Best SPL Reviewer (slides | video ) - Splunk .conf 2021, Samsung Electronics (slides 10-19)