topic Re: Splunk API comparison to btool command in Security

Splunk API comparison to btool command

rohitmaheshwari — Sun, 07 Jun 2020 17:36:29 GMT

I am using Splunk version 7.3.2.

I am trying to find the runtime input configuration on a Splunk heavy forwarder using Rest API endpoint.
I have noticed a difference in results when accessing the input configuration on a heavy forwarder using btool in comparison to Splunk API endpoint.
Some of the monitoring input stanzas that appear on the Splunk instance when using btool are not part of the API call results.

Rest API Call:
The Rest API call uses the ‘GET’ method to retrieve the configured inputs from the endpoint ‘https://somethingishere:8089/services/data/inputs/monitor’.
The btool command:
Command used for ‘btool ‘ and filtered on the keyword syslog:
./splunk btool inputs list

Is there an endpoint to capture the current running monitor input configurations?? ..or another way of doing this.

Re: Splunk API comparison to btool command

richgalloway — Wed, 22 Apr 2020 14:28:54 GMT

Recall that btool shows the contents of the config files, which is not always what Splunk is currently running. Output of btool is what Splunk will run the next time it restarts.

The endpoint for capturing currently monitored inputs is what you already use - services/data/inputs/monitor.

There is also the CLI command splunk list monitor.

Re: Splunk API comparison to btool command

rohitmaheshwari — Thu, 23 Apr 2020 01:27:28 GMT

So, if in case I have a monitor stanza which monitors a file [monitor:///abc/syslog/xyz/*.log] and this monitor is enabled as in if there was a .log file present under the xyz directory splunk would be monitoring this file.

This monitor shows up in the btool as this is the run time config that is currently running on the instance.

This monitor should also show up in the rest query..I am hoping to see this config using rest calls.

Re: Splunk API comparison to btool command

gjanders — Thu, 23 Apr 2020 03:36:36 GMT

"This monitor shows up in the btool as this is the run time config that is currently running on the instance.
"

That is not correct, btool shows the filesystem level configuration, not the currently active configuration.
Currently active configuration you can find via REST endpoints

If you are unsure which endpoint either check the REST API docs or try Config Quest

Re: Splunk API comparison to btool command

richgalloway — Thu, 23 Apr 2020 12:08:14 GMT

Run the CLI command I mentioned. It will tell you which files are being monitored.