topic Re: Using btool command in Monitoring Splunk

Using btool command

kannu — Fri, 18 Aug 2017 11:23:54 GMT

Using btool command i want to check all the conf file or get a list of all conf files where my xyz host entry is present . for example my host name is abc.com and in that splunk is running so using btool i need to check all conf file where entry of abc.com is present . Anyone please provide btool cmd syntax for this.

Re: Using btool command

adonio — Fri, 18 Aug 2017 11:45:30 GMT

is the hostname is a splunk instance?
if not, why would a hostname will be in your .conf files?
i think that the btool command has to identify a .conf file (and an app if needed) but can not be ran "global" per-se
with that being said, you can ran the command :

./splunk cmd btool <conf_file_prefix> list | grep abc.com

hope it helps a little

Re: Using btool command

jkat54 — Fri, 18 Aug 2017 18:19:01 GMT

since btool requires the conf file prefix, do this instead:

For Linux (bash):

 for file in 'find /opt/splunk -type f -name "*.conf"'; do echo $file; grep abc.com $file;done

For Windows (powershell):

Get-ChildItem 'C:\Program Files\Splunk' -Recurse -ErrorAction SilentlyContinue | Where-Object {$_.Name -ilike "*.conf"} | Foreach-Object {Write-Host $_.FullName; Get-Content $_.FullName | Select-String -Pattern abc.com}

Remove "-ErrorAction SilentlyContinue" if you'd like to get permission denied errors on files your user doesnt have access to.

Also, modify the paths as needed. Your Splunk might be installed in different locations.

Re: Using btool command

kannu — Mon, 21 Aug 2017 09:57:00 GMT

Hi adonio ,

thank you for the quick reply

actually yes that hostname is running the splunk instance and currently working as indexer for my distributed env setup

Re: Using btool command

kannu — Mon, 21 Aug 2017 10:11:04 GMT

Hi jkat54,

I need to check in all configrations file only, Btool will help .
Please provide btool expression.

And thank you for the quick reply 🙂

Re: Using btool command

jkat54 — Mon, 21 Aug 2017 11:10:55 GMT

Again, btool will not check in ALL configs.

Syntax is as follows

./splunk btool <configFileName> list --debug

You cannot use a wildcard like this:

./splunk btool * list --debug

It doesn't work. So I have provided you with how to do what you want (not using btool).

Re: Using btool command

adonio — Mon, 21 Aug 2017 12:13:20 GMT

@jkat54 provided you a valid answer imho