Getting Data In

How can I use btool to find where a specific index was created?

brentrmc
Explorer

I've been tasked with using btool (in debug mode) to find where the settings for the “onboarding” index was written by the GUI, and can't seem to figure out exactly how to do so. Any help is much appreciated!

Tags (1)
0 Karma
1 Solution

diogofgm
SplunkTrust
SplunkTrust

Use the following command on CLI:

splunk btool indexes list --debug your_index_name

------------
Hope I was able to help you. If so, some karma would be appreciated.

View solution in original post

diogofgm
SplunkTrust
SplunkTrust

Use the following command on CLI:

splunk btool indexes list --debug your_index_name

------------
Hope I was able to help you. If so, some karma would be appreciated.

jkamdar
Path Finder

@diogofgm thanks, I keep forgetting using btool 😞

So when I run the command you suggested, I see {default] section earlier than my specific index like, [ubunt], [rhel]. So I assume, the whatever came 1st under [default] (in my case, "frozenTimePeriodInSecs") would apply and no what I have under [ubuntu] or [rhel], correct?

Thanks for your help. 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

You should create a new question instead of continuing with solved one.

In indexes.conf and other you should look https://docs.splunk.com/Documentation/Splunk/9.4.0/Admin/Indexesconf and check what those sections means. With indexes there are global section which put some global values and also some defaults for all indexes stanzas. Per indexes part are defined attributes and values for individual index. There are some items which can only defined here and some which can defined also on global level if those are defined on both then index specific wons.

There is also app https://splunkbase.splunk.com/app/6368 which you could use inside GUI without  cli access.

0 Karma

jkamdar
Path Finder

@isoutamo Sorry, my bad. Not sure, how ended up finding that post. I will keep in mind.

0 Karma

brentrmc
Explorer

Awesome, thank you!

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...