topic Re: How do you determine the rendered configuration as applied to a specific source? in Getting Data In

How do you determine the rendered configuration as applied to a specific source?

krisreeves — Fri, 30 Nov 2018 21:24:13 GMT

splunk btool is a helpful tool that allows you to determine the result of merging the config on disk, but it doesn't help you to determine whether that config was applied to a given event. Is there any way to do this?

Context: I'm adding some broad configuration to certain sources, but I had to use a regular expression (negative lookahead) to exclude certain subpaths. I'm still getting some warnings in Splunk's internal logs about the timestamp format changing, which makes me uncertain that the config I wrote for timestamp parsing is actually applying to the log that Splunk is complaining about.

Re: How do you determine the rendered configuration as applied to a specific source?

woodcock — Fri, 30 Nov 2018 22:23:39 GMT

There is no good way to do that but you can add --debug to btool and it will show you the files that contain the values that apply.

Re: How do you determine the rendered configuration as applied to a specific source?

krisreeves — Fri, 30 Nov 2018 22:57:05 GMT

I do know about --debug, but that doesn't tell me if Splunk is using what I'm seeing on the screen when processing data 😞

I'm currently working on attempting to add a static metadata field with transforms/props so that I can see when the config block has been applied. Thanks for confirmation though!