Is there a simple way to get all config files from $SPLUNK_HOME/etc?

[danielbb]

A fellow here would like to compare the config files across a cluster of three SHs. So, what's an easy way to get all the config files under $SPLUNK_HOME/etc?

We thought about getting the diags from these three, or run the btool for each config file. Is there a way to get all the config files via a nice Unix command?

[bcusick_splunk]

Hi Daniel - try this on for size:

find /opt/splunk/etc/ -type f -name '*.conf' | grep -v README | awk -F/ '{print $NF}' | awk -F\. '{print $1}' | sort -u > btool_list.txt; for i in $(cat btool_list.txt); do splunk btool $i list; done > complete_btool_output.txt

[danielbb]

Worked perfectly fine - thank you.

[MuS · Accepted solution]

Hi danielbb,

Sadly there is no single show them all command in Splunk but have a look at this answer https://answers.splunk.com/answers/293407/how-do-i-show-the-running-configuration-on-my-forw.html#an... it will show an example to list all Splunk .conf files.
With the output you can compare it server by server.

Hope this helps ...

cheers, MuS

[danielbb]

@MuS, it's great but find /opt/apps/splunk/etc | grep .conf | grep -v README | awk -F/ '{ print $NF }' seems to need some improvements ... on one server find /opt/apps/splunk/etc | grep .conf | grep -v README | awk -F/ '{ print $NF }' | wc -l returns 3339 files...

[MuS]

If you improve the find you might end up missing some files but feel free to modify the find in anyway that works better for you 🙂

cheers, MuS

[danielbb]

Ok - will do... : )