icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.
Splunkbase will be undergoing a scheduled migration and will be unavailable on Saturday, Oct 1, 2022, from 11AM to 3PM PDT

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading KSCONF
SHA256 checksum (ksconf_092.tgz) 22781cba0012fa1eb0e6c00a3df9b1bc45e2dafd1bb91bd5d095d1036b39c719 SHA256 checksum (ksconf_091.tgz) 50881aba82a1e3c3cb41cb982b679ed2345794bd6d070908b010c87e311491a9 SHA256 checksum (ksconf_090.tgz) 6d583ed378fad99e4a5a0e75ccfe8c11b3582acea6fbf6dd953b0ea530de9488 SHA256 checksum (ksconf_087.tgz) 25460fef3c4f3949bf2a7fad9c67a9bde656015b6a231da1f9ecab56db1f4e56 SHA256 checksum (ksconf_086.tgz) 90f73365a3dcd0a310f51f6122e9135b8bc740dafb8899bbe604293a6651c280 SHA256 checksum (ksconf_084.tgz) 88389dde6e1933c6426f82a90d7fc6dbe8d31a73fa9f81534f7152b6324d059d SHA256 checksum (ksconf_083.tgz) f57076115d3211955bd1b96021b260d76f9382067d174f4b519fb8d7194ff889 SHA256 checksum (ksconf_0710.tgz) 9b6bcf91eb4fad8e63c385203ef2e9e9f69437a59cf3dc1d00a9ae4fafa740c5 SHA256 checksum (ksconf_078.tgz) 21e1595e16ff61fdafeb4ea192d2f99c7dbfb1f267066bbd847a72911277d64f SHA256 checksum (ksconf_077.tgz) 019fb19356e3abc03e41876318171a44e6dab6604a4a40eca1df6b737a4f5487 SHA256 checksum (ksconf_076.tgz) 60142fe6a20232eab899dbd9f6b7b0db0f1b3242a506ebf74afc03ddc4f0cf62 SHA256 checksum (ksconf_075.tgz) d75eb6d181b614872799b5af054c039748dd2ebda120c33f0a07a2d936df418e SHA256 checksum (ksconf_074.tgz) 6f62d4e0a2c3666b111e90263653803b42fc2d05852413bb0f7aa8eee2f9343f SHA256 checksum (ksconf_073.tgz) 899a3c007b3a1940ece8e1c52e033c36a2a12ae5ef36b071162d6954d74cd360 SHA256 checksum (ksconf_072.tgz) 4670e324a14763ac4ef969a385c472bc7db1fc176e8882d241b7158c9e49f469 SHA256 checksum (ksconf_071.tgz) ed514548036306dc62a0af6fd5e384eb52d305f76c3d15277dd45c2e4d2c8290 SHA256 checksum (ksconf_070.tgz) ba4b64d90b4e1bb26a30bf464344d7dc0a1b1e086cd915027c67ee2a4b33a5b8 SHA256 checksum (ksconf_062.tgz) a26908ad95ac1d64c1da7feeaec2b3a8815a155b49df90ef3a87b445d99c1e78 SHA256 checksum (ksconf_061.tgz) 305686e444f443d3184b135d4e98f0ce4ceb4ef44d09520d5d634cfb437abd25
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate



Git and Splunk don't always fit together perfectly. Introducing KSCONF, a tool written to alleviate arduous tasks associated with managing Splunk apps in a git repository. This open source tool supports many functions to help both admins and developers manage Splunk content in git in a simple way without getting stuck in the details.


What is KSCONF?

KSCONF is a command-line tool that helps administrators and developers manage their Splunk environments by enhancing control of their configuration files. The interface is modular so that each function (or subcommand) can be learned quickly and used independently. While most users will probably only use a subset of the total capabilities of this tool, it’s reassuring to have a comprehensive toolbox of powerful assets ready to be utilized at a moment's notice. Ksconf works with, rather than replace, your existing Splunk deployment mechanisms and version control tools.

KSCONF is open source and an open development effort. Check us out on GitHub

Pronounced: k·s·kȯnf

Design principles

  • Ksconf is a toolbox. - Each tool has a specific purpose and function that works independently. Borrowing from the Unix philosophy, each command should do one small thing well and be easily combined to handle higher-order tasks.
  • When possible, be familiar. - Various commands borrow from popular UNIX command line tools such as “grep” and “diff”. The overall modular nature of the command is similar to the modular interface used by “git” and the “splunk” cli.
  • Don’t impose workflow. - Ksconf works with or without version control and independently of your deployment mechanisms. If you are looking to implement these things, ksconf is a great building block.
  • Embrace automated testing. - It’s impractical to check every scenario between each release, but significant work has gone into unit testing the CLI to avoid breaks between releases.

Common uses for ksconf

  • Promote changes from “local” to “default”
  • Maintain multiple independent layers of configurations
  • Reduce duplicate settings in a local file
  • Upgrade apps stored in version control
  • Merge or separate configuration files
  • Push .conf stanzas to a REST endpoint (send custom configs to Splunk Cloud)

What's in the KSCONF App for Splunk?

This Splunk app comes bundled with a CLI tool that helps manage other Splunk apps. While this is not a traditional use case for a Splunk app, it is a very quick and easy way to deploy ksconf.

Why did we make this a Splunk app? While ksconf is technically just a Python package that can be deployed in a variety of ways, we found that the logistics of getting it deployed can be quite difficult due to a packaging issues, legacy cruft, and OS limitations. This approach avoids all that mess.

Getting Started

Full documentation for ksconf, including this app, is hosted at read-the-docs. A full copy of the ksconf documentation is also included, similar to how Splunk ships with a full copy of the docs in the system/README folder. (And all the air-gapped people rejoice! but sadly, no one could hear them.)


Need help?

Get Involved


Additional Splunk UI features are planned, but currently not implemented.

  • Dashboard to track all changes coordinated by ksconf
  • Configuration snapshot tracking
  • Custom SPL command to give visibility into what exists in the local folder. (The built-in rest command only shows you the final merged view of your settings; and sometimes you have to look deeper.)

Installation & Configuration

See the Install an add-on in Splunk's official documentation. There is one manual step required to activate the CLI portion of this app, if you choose to do so. See the Installation docs for more details.


Community support is available on best-effort basis. For information about commercial support, contact Kintyre
Issues are tracked via GitHub


See the full Change log

Release Notes

Version 0.9.2
March 4, 2022
  • The filter command can now include/exclude stanzas based on the boolean value of disabled using the new --enabled-only or --disabled-only arguments. The default behavior remains the same, that is, the disabled attribute is completely ignored.
Version 0.9.1
March 4, 2022
  • Ksconf now tries harder to preserve file modification times. This is supported in merge, combine and package commands.
    Specifically, merged .conf files and concatenated files will keep the most recent modification time in the destination.
    This should make the output of `ombine and package (by extension) more deterministic in many scenarios.
Version 0.9.0
Aug. 13, 2021
  • Expand use cases for ksconf combine with new --keep-existing <pattern> and --disable-cleanup arguments.
  • Support ksconf promote by combining --stanza <pattern> and --summary or --diff options at the same time.
  • New ksconf diff output options for (1) setting detail level using --detail {global,stanza,key} and (2) new JSON output format with --format json. Fixed an diff output bug and some inconsistencies in space.
  • Allow enabling/disabling TTY colors via environmental variable: KSCONF_TTY_COLOR={auto,force,off}. This can also be done with --disable-color CLI option.

Read the full change log here:

Version 0.8.7
April 30, 2021
  • Support combining *.conf.spec files in ksconf combine, thus allowing README.d to be it's own layer.
  • Fixed potential ksconf unarchive issue with older version of git where git add DIR didn't assume the --all option. So if you're stuck on git 1.7/1.8 ksconf should still work
Version 0.8.6
April 20, 2021
  • Fixed install.py Splunk app CLI install helper script to support referencing a specific version of Python. This allows Splunk 8.0 user sto run ksconf using Python3, for example.
  • Minor doc tweaks
  • Fixed ASCII art issue.

Full list:

Version 0.8.4
March 24, 2021

Build and packaging enhancements

  • CLI change: Replaced short option for --allowlist to be -a, before it was -w.
  • Add some safety checks to the package command to check for app naming issues and hidden files and directories.
  • Added {{app_id}} variable to ksconf package command.
  • Added a new optional argument to copy_files() for additional control over the destination path in the build folder.
  • Minor tweak to unhandled exceptions. The name of the exception class is now shown.
  • When using make_missing in update_conf(), missing directories will now be created too.
  • Additional fixes to the Ksconf for Splunk App build.py script

See details here: https://ksconf.readthedocs.io/en/v0.8.4/changelog.html#ksconf-v0-8-4-2020-03-22

Version 0.8.3
March 21, 2021
  • New command ksconf package is designed for both Splunk developers and admins. This includes simple but helpful options to merge ‘local’ into ‘default’, set the an app version, set the top-level folder name (if it’s different on the file system), and so on.
  • New module ksconf.builder helps build Splunk apps using a pipeline; or when external Python libraries are bundled into an app
  • Legit layer support with built-in layer filtering capabilities is available in several commands. Now you can easily have layers for both "default" and "lookups", for example.
  • Python 3! Head's up: We'll be dropping support for Python 2 in an upcoming release

Official change log: https://ksconf.readthedocs.io/en/latest/changelog.html#ksconf-0-8

Version 0.7.10
March 19, 2021

Empty stanza bug fix

  • Fixed bug where empty stanzas in the local file could result in stanza removal in default with ksconf promote.
  • Updated ksconf diff interface to improve handling of empty stanzas
Version 0.7.8
June 20, 2020
Version 0.7.7
June 20, 2020
Version 0.7.6
Aug. 16, 2019
Version 0.7.5
July 3, 2019
Version 0.7.4
June 8, 2019
Version 0.7.3
June 5, 2019
Version 0.7.2
March 22, 2019
Version 0.7.1
March 14, 2019
Version 0.7.0
Feb. 28, 2019

This release fixes up packaging issues with python package folders that may caused issues after upgrades. Unfortunately, this means everyone who had installed 0.6.x should uninstall and do a fresh install of 0.7.0. Hopefully this issue is resolved and extra steps like this won't be required in the future.

As always, read the full change log here:

Version 0.6.2
Feb. 9, 2019
Version 0.6.1
Feb. 7, 2019

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.