topic Re: Using "btool inpust list" monitor stanza is missing, but not when using "btool -app=xx inputs list" in Getting Data In

Using "btool inpust list" monitor stanza is missing, but not when using "btool -app=xx inputs list"

rune_hellem — Thu, 30 May 2019 19:29:06 GMT

Using command splunk btool --app=operations_inputs_prod inputs list the following is listed

[monitor://D:\logs\powershell\*.log]
index = klpoperations
sourcetype = log4net
whitelist = .*\.log

But if I try the command without the --app to list all configuraitons, the one above is missing, but not the three others in the file, and I'm not able to figure out why. I have tried a lot of different things, reloading the deploy-server a lot of times.

splunk btool inputs list

Re: Using "btool inpust list" monitor stanza is missing, but not when using "btool -app=xx inputs list"

ddrillic — Thu, 30 May 2019 20:11:48 GMT

On which server are you running the btool command, the forwarder or the deployment server?

Re: Using "btool inpust list" monitor stanza is missing, but not when using "btool -app=xx inputs list"

rune_hellem — Thu, 30 May 2019 20:21:31 GMT

On the forwarder...

Re: Using "btool inpust list" monitor stanza is missing, but not when using "btool -app=xx inputs list"

koshyk — Thu, 30 May 2019 20:59:39 GMT

Best thing is to do is to use debug , so you know exactly which APP the stanza is coming from. Then you can do app specific btool

splunk cmd btool inputs list debug > /tmp/inputs.btool.txt

you should see each line, which app it belongs to..

Re: Using "btool inpust list" monitor stanza is missing, but not when using "btool -app=xx inputs list"

rune_hellem — Fri, 31 May 2019 07:30:21 GMT

Well, it provides all details about the stanzas that the forwarder is configured to use, but still it won't explain why the one stanza is not part of the output, but the three others are.

It is worth mentioning that there are other inputs.conf for other indexes on the same server which are identical and are to be found in the config. So it should not be anything wrong with the missing stanza, they are identical.