topic Re: btool cheat sheet in Getting Data In

btool cheat sheet

youngsuh — Thu, 20 Aug 2020 01:39:34 GMT

Does anyone have a cheat sheet for btool to help newbies?

Here is my version of btool cheat sheet:

splunk btool <conf_file_prefix> <sub-cmd> <context> --debug "%search string%" splunk show config <config file name> | grep -v "system\/default" Step 1. splunk btool inputs list --debug "%search string%" >> /tmp/splunk_inputs.txt Step 2. Import into excel using space as a separator. Step 3. Use excel to filter feature to look for the settings

Explanation:

<conf_file_prefix>: props, inputs, outputs, transforms

<sub-cmd>: list, display, user, dir

<context>: --app=search

"%serch string%": input the search you're looking for

I'd prefer piping the command to "less" command.

Splunk documents: https://docs.splunk.com/Documentation/Splunk/8.0.5/Troubleshooting/CommandlinetoolsforusewithSupport#btool

https://docs.splunk.com/Documentation/Splunk/8.0.5/Troubleshooting/Usebtooltotroubleshootconfigurati...

https://docs.splunk.com/Documentation/Splunk/8.0.5/Troubleshooting/CommandlinetoolsforusewithSupport

External Site:

https://splunkonbigdata.com/2018/10/03/splunk-btool/

Thanks, everyone who replied. I'd consolidated the information into the top page.

Re: btool cheat sheet

gcusello — Wed, 19 Aug 2020 15:42:51 GMT

Hi @youngsuh,

I didn't find a page as you would and it's a strange thing because Splunk documentation is usually very complete and structured.

Anyway, in these pages, you can find all the infos you need:

https://docs.splunk.com/Documentation/Splunk/8.0.5/Troubleshooting/Usebtooltotroubleshootconfigurations

https://docs.splunk.com/Documentation/Splunk/8.0.5/Troubleshooting/CommandlinetoolsforusewithSupport

https://splunkonbigdata.com/2018/10/03/splunk-btool/

Ciao.

Giuseppe

Re: btool cheat sheet

richgalloway — Wed, 19 Aug 2020 15:53:55 GMT

Try

splunk btool help

I prefer to pipe btool output to

grep -v "system\/default"

to eliminate noise from the default settings.

Re: btool cheat sheet

isoutamo — Wed, 19 Aug 2020 16:06:40 GMT

And remember that what you got from btool is what is on disk. If/when you want to see what is running config you must use

splunk show config <config file name>

r. Ismo

Re: btool cheat sheet

gcusello — Thu, 20 Aug 2020 09:26:44 GMT

Hi @youngsuh,

happy splunking!

Ciao.

Giuseppe

P.S.: Karma Points are appreciated by me and the other contributors 😉

Re: btool cheat sheet

Abhay — Tue, 16 Nov 2021 04:36:22 GMT

https://splunkonbigdata.com/splunk-btool/

This is the new link for btool in Splunkonbigdata.com

Re: btool cheat sheet

yulsplunkops — Thu, 05 Dec 2024 00:04:16 GMT

I use the good old grep command when I needed a list of indexes referenced in all inputs on all folders ; like this:

splunk btool inputs list --debug | grep index

Re: btool cheat sheet

mwk1000 — Mon, 14 Jul 2025 13:43:06 GMT

that is my 99% use case for btool , the aggregated list of xxxxx.conf by file --debug then filter with grep.

Re: btool cheat sheet

isoutamo — Mon, 14 Jul 2025 13:53:30 GMT

If you know stanza name you should add also it.
Currently there is also splunk app called Admin's little helper, which you could use to run btool from MC or splunk cloud. I strongly recommended to install and use it in any distributed environments!

https://splunkbase.splunk.com/app/6368