topic Re: btool app line breaking issues in Monitoring Splunk

btool app line breaking issues

sbattista09 — Thu, 28 Jun 2018 16:52:18 GMT

any one else having issues when testing the btool app on a UF where the events are signal line and not merged by stanza? I am having no luck using BREAK_ONLY_BEFORE = \[

Current default props.conf:

[source::*/bin/btool.sh*]
DATETIME_CONFIG = CURRENT
BREAK_ONLY_BEFORE = ^.*?\/etc\/(apps|system|slave-apps)\/(?:(.*?)\/)?(default|local)\/(?<file>\w+\.conf)\s+\[(?<stanza>.+?)\]$

[splunk:config:btool:app]
EXTRACT-btool = (?<SPLUNK_HOME>.*?)/etc/(?<app_folder>apps|master-apps|slave-apps)/(?<app>[^/]*)/(default|local)/(?<file>\w+\.conf)\s+\[(?<stanza>.+)\]


# hack for sourcetype wildcards
# c.f https://answers.splunk.com/answers/8505/is-it-possible-to-use-wildcards-in-sourcetype-props-conf-stanzas.html
# c.f. SPL-117030
[(?::){0}splunk:config:btool:*]
EXTRACT-btool = etc/((apps|master-apps|slave-apps)/)?[^/]+/(default|local)/(?<file>\w+\.conf)\s+\[(?<stanza>.+?)\]

Re: btool app line breaking issues

richgalloway — Thu, 28 Jun 2018 16:57:00 GMT

How are you running btool? What output are you expecting?

Re: btool app line breaking issues

sbattista09 — Thu, 28 Jun 2018 18:19:18 GMT

with the btool app, its using scripts called from inputs.conf.

################################
# Btool Scripted Input
################################


[script://./bin/btool.sh inputs]
interval = 140
sourcetype = splunk:config:btool:inputs
disabled = 0
index = test

[script://./bin/btool.sh outputs]
interval = 140
sourcetype = splunk:config:btool:outputs
disabled = 0
index = test

[script://./bin/btool.sh app]
interval = 140
sourcetype = splunk:config:btool:app
disabled = 0
index = test

Re: btool app line breaking issues

somesoni2 — Thu, 28 Jun 2018 18:37:56 GMT

Give this a try

[source::*/bin/btool.sh*]
 DATETIME_CONFIG = CURRENT
 SHOULD_LINEMEREGE = false
 LINE_BREAKER= ([\r\n]+)(?<.*?\/etc\/(apps|system|slave-apps))

Re: btool app line breaking issues

woodcock — Sat, 30 Jun 2018 14:07:30 GMT

If the events are single-line then you should be using the default LINE_BREAKER Also, if you are pulling in the output from btool, then be aware that there are some GREAT apps out there that help you to do this:

https://splunkbase.splunk.com/apps/#/search/btool/

Re: btool app line breaking issues

sbattista09 — Mon, 02 Jul 2018 18:18:51 GMT

config quest would be amazing if it was for universal forwarders. My question above is for the Btool Scripted Inputs for Splunk.

Re: btool app line breaking issues

woodcock — Mon, 02 Jul 2018 18:43:23 GMT

URL for what you are doing? Several of us have no clue for context.

Re: btool app line breaking issues

sbattista09 — Mon, 16 Jul 2018 13:51:24 GMT

i am trying to find out what servers have local input.conf files that are not being pushed out from our deployment server. I would like to use something like the btool app so we can grab the stanzas and wrap them up into a deployment app then, have the server admins remove the local inputs.conf configs.

Re: btool app line breaking issues

cyrillefranchet — Wed, 17 Oct 2018 15:59:51 GMT

Did you find any solution? I don't see why this isn't working properly.