topic Re: How to run btool as REST command or via Search GUI? in Monitoring Splunk

How to run btool as REST command or via Search GUI?

koshyk — Tue, 05 Feb 2019 10:38:46 GMT

We were looking to run btool on requirement basis for configs across whole of splunk cluster. It is not feasible to run via cmd line on individual servers. I had a plan to write it as an app and share it across all tiers, but just wanted to check if

any REST endpoints for btool? (currently no mention in splunk docs)
Can btool be run as an SPL ? Any hint/ideas would be welcome.

(I'm aware of https://answers.splunk.com/answers/694707/is-there-a-way-to-run-cmd-btool-check-via-rest.html , but that's same effort as writing an app across all tiers)

Re: How to run btool as REST command or via Search GUI?

chrisyounger — Tue, 05 Feb 2019 11:38:44 GMT

Hi @koshyk

I am pretty sure there is no rest api to get the output of btool. I wrote an app that runs btool on a servers and saves it to a file (it then commits the files to a git repository). you could pick apart my code to do what you want. The app is here https://splunkbase.splunk.com/app/4182/#/overview and here is the lines of code you can use: https://github.com/ChrisYounger/git_for_splunk/blob/master/bin/input_module_gitforsplunk.py#L51

Hope you find this helpful

Re: How to run btool as REST command or via Search GUI?

koshyk — Tue, 05 Feb 2019 14:11:19 GMT

Much appreciated. Upvoted
I was thinking of similar approach as an app myself, as I was thinking of making it more simple scripted input based approach. But quite painful for us to get into all tiers of huge splunk environment.

Hopefully will wait for any other ideas and will accept in few days.

Re: How to run btool as REST command or via Search GUI?

esix_splunk — Tue, 05 Feb 2019 14:19:35 GMT

There is no btool endpoint, however you can access all of the configurations on the machine via the conf-file endpoints..

https://servername:mgmt/services/configs/conf-{file}

So you can do https://localhost:8089/services/configs/conf-props or https://localhost:8089/services/configs/conf-server.

Additionally you can do this via SPL..

| rest  splunk_server=local /services/configs/conf-props | transpose

If you do this in a distributed environment, be aware of you peers and adjust the splunk_server= to the servers you want to collect the configs from.

Re: How to run btool as REST command or via Search GUI?

koshyk — Tue, 05 Feb 2019 15:27:55 GMT

Also a great idea. But anyway to ensure the [stanza] can be attached to each item?

Re: How to run btool as REST command or via Search GUI?

esix_splunk — Tue, 05 Feb 2019 16:04:42 GMT

What do you mean to each item?

Re: How to run btool as REST command or via Search GUI?

badrinath_itrs — Mon, 20 Jan 2020 00:01:52 GMT

The configuration errors are being recorded in splunkd_stdout.log with "Invalid key in stanza" during server restart. May be worth of getting this information from this log instead of running rest command.

Re: How to run btool as REST command or via Search GUI?

gabriel_vasseur — Thu, 18 Aug 2022 10:49:13 GMT

esix_splunk's answer is great and use rest searches worked for us on-prem, however splunk cloud doesn't allow you to query the indexers, for some security reason. I'm pretty sure they wouldn't allow a scripted input running btool on the indexers either.

Someone at splunk recommended https://splunkbase.splunk.com/app/6368/ and we had no trouble getting it installed on cloud and it's working well for us. Not sure how it does it but it works.

Re: How to run btool as REST command or via Search GUI?

Siddharth — Fri, 19 Aug 2022 11:14:40 GMT

If you want download the app config explorer in that you can run such things like btool and other things on UI

Be generous and leave a like if it helps 🙂