topic Re: How can I use btool to find where a specific index was created? in Getting Data In

How can I use btool to find where a specific index was created?

brentrmc — Mon, 02 Sep 2019 16:16:47 GMT

I've been tasked with using btool (in debug mode) to find where the settings for the “onboarding” index was written by the GUI, and can't seem to figure out exactly how to do so. Any help is much appreciated!

Re: How can I use btool to find where a specific index was created?

diogofgm — Mon, 02 Sep 2019 16:31:06 GMT

Use the following command on CLI:

splunk btool indexes list --debug your_index_name

Re: How can I use btool to find where a specific index was created?

brentrmc — Mon, 02 Sep 2019 16:33:55 GMT

Awesome, thank you!

Re: How can I use btool to find where a specific index was created?

jkamdar — Tue, 14 Jan 2025 18:35:19 GMT

@diogofgm thanks, I keep forgetting using btool 😞

So when I run the command you suggested, I see {default] section earlier than my specific index like, [ubunt], [rhel]. So I assume, the whatever came 1st under [default] (in my case, "frozenTimePeriodInSecs") would apply and no what I have under [ubuntu] or [rhel], correct?

Thanks for your help.

Re: How can I use btool to find where a specific index was created?

isoutamo — Tue, 14 Jan 2025 18:58:42 GMT

You should create a new question instead of continuing with solved one.

In indexes.conf and other you should look https://docs.splunk.com/Documentation/Splunk/9.4.0/Admin/Indexesconf and check what those sections means. With indexes there are global section which put some global values and also some defaults for all indexes stanzas. Per indexes part are defined attributes and values for individual index. There are some items which can only defined here and some which can defined also on global level if those are defined on both then index specific wons.

There is also app https://splunkbase.splunk.com/app/6368 which you could use inside GUI without cli access.

Re: How can I use btool to find where a specific index was created?

jkamdar — Tue, 14 Jan 2025 19:09:19 GMT

@isoutamo Sorry, my bad. Not sure, how ended up finding that post. I will keep in mind.

Re: How can I use btool to find where a specific index was created?

sohailmohammed — Tue, 09 Dec 2025 20:47:30 GMT

/SplunkHOME/bin/Splunk btool indexes list --debug | grep your_index_name

Re: How can I use btool to find where a specific index was created?

sohailmohammed — Tue, 09 Dec 2025 20:48:11 GMT

Plus you can try out Admin Little Helpers app that will give you btool access from GUI