topic Re: How do I show the running configuration on my forwarder? in Getting Data In

How do I show the running configuration on my forwarder?

vqd361 — Thu, 06 Aug 2015 22:05:09 GMT

I want to view what Splunk sees as the running config for my universal forwarder. I read on http://blogs.splunk.com/2012/10/02/tips-and-tricks-for-the-new-guy/ that I can run ./splunk cmd btool list but that shows me the help page. The blog also says that the command takes a config file parameter, but I don't know what the options are for the config files. Besides, I want to see all of the config info, not just one piece.

How do I tell Splunk to show me all of the config?

Re: How do I show the running configuration on my forwarder?

gcato — Thu, 06 Aug 2015 22:17:58 GMT

You can view Splunk documentation on the btool here

http://docs.splunk.com/Documentation/Splunk/6.2.4/Troubleshooting/Usebtooltotroubleshootconfigurations
http://docs.splunk.com/Documentation/Splunk/6.2.4/Troubleshooting/CommandlinetoolsforusewithSupport

Re: How do I show the running configuration on my forwarder?

vqd361 — Thu, 06 Aug 2015 22:21:31 GMT

thanks, but I already looked at those and they didn't help.

Re: How do I show the running configuration on my forwarder?

MuS — Thu, 06 Aug 2015 22:33:07 GMT

Hi vqd361,

in regards of all config at once, as far as I know this is not possible.
But you could do some wrapper script that finds all your .conf files and use them with the btool command like this :

 for i in ` find /opt/splunk/etc | grep .conf | grep -v README | awk -F/ '{ print $NF }'`; do /opt/splunk/bin/splunk cmd btool $i list; done

Hope this helps ...

cheers, MuS

Re: How do I show the running configuration on my forwarder?

woodcock — Thu, 06 Aug 2015 22:44:52 GMT

Like @MuS said, the basic command format is like this:

$SPLUNK_HOME/bin/splunk cmd btool inputs list --debug

The --debug part is frequently important in tracking down "wrong" but not "broken" configurations.

Re: How do I show the running configuration on my forwarder?

gcato — Thu, 06 Aug 2015 23:02:27 GMT

The following link shows a worked example of using the btool from Splunk support (about half way through the video): https://www.youtube.com/watch?v=kuUf4qgL2wI

Re: How do I show the running configuration on my forwarder?

wrangler2x — Wed, 30 May 2018 17:04:55 GMT

You can use $SPLUNK_HOME/bin/splunk show config configname, where configname is the name of one of *.conf

So, for example (Assuming that splunk is $SPLUNK_HOME/bin/splunk) you could do:

$ splunk show config web

$ splunk show config inputs

$ Splunk show config outputs

and so on.

Re: How do I show the running configuration on my forwarder?

GDustin — Mon, 25 Nov 2019 23:31:43 GMT

that first little link in the comments has/appears to have had it;
https://docs.splunk.com/Documentation/Splunk/8.0.0/Troubleshooting/Usebtooltotroubleshootconfigurations

"To view current in-memory configurations, query the REST endpoint /services/properties/"

Re: How do I show the running configuration on my forwarder?

GDustin — Mon, 25 Nov 2019 23:36:01 GMT

show says specified conf file, not what is currently running;
Example:
/opt/splunkforwarder/bin/splunk help show |grep -i config
show config show the details of a specified conf file. (NOTE: this command will only work if the file exists in the location specified by $SPLUNK_HOME/etc/system/default/conf.conf)

Re: How do I show the running configuration on my forwarder?

GDustin — Wed, 30 Sep 2020 03:08:18 GMT

look at the first link again; 3rd paragraph;
http://docs.splunk.com/Documentation/Splunk/6.2.4/Troubleshooting/Usebtooltotroubleshootconfigurations
"To view current in-memory configurations, query the REST endpoint /services/properties/."

FYI: the config file parameter is the stanza name inside square brackets [] inside the conf file;

with the rest call you have to URL encode the config file parameter/stanza name;
example:
/opt/splunkforwarder/bin/splunk show config inputs list monitor:///var/syslog-ng/log/ironport_xxx

Becomes:
/opt/splunkforwarder/bin/splunk _internal call /services/properties/inputs/monitor%3A%2F%2F%2Fvar%2Fsyslog-ng%2Flog%2Fironport_xxx

one way you can reference the url encoding by walking up one up in the REST call and then inspect and copy/paste your target quickly from the parameter; [it appears to come out in json; id]

/opt/splunkforwarder/bin/splunk _internal call /services/properties/inputs
/opt/splunkforwarder/bin/splunk _internal call /services/properties/inputs |grep -i ironport

Re: How do I show the running configuration on my forwarder?

GDustin — Mon, 25 Nov 2019 23:50:58 GMT

*
https://docs.splunk.com/Documentation/Splunk/6.2.4/Troubleshooting/Usebtooltotroubleshootconfigurations

Re: How do I show the running configuration on my forwarder?

nsanzar_splunk — Mon, 18 Jan 2021 20:28:58 GMT

Run this in your bin dir to view all your settings in memory on CLI for each respective .conf file:

./splunk show config <filename_without_.conf>

For example, to view inputs.conf (you might have to pipe it into less):

./splunk show config inputs