Getting Data In

How can I use btool to find where a specific index was created?

brentrmc
Explorer

I've been tasked with using btool (in debug mode) to find where the settings for the “onboarding” index was written by the GUI, and can't seem to figure out exactly how to do so. Any help is much appreciated!

Tags (1)
0 Karma
1 Solution

diogofgm
SplunkTrust
SplunkTrust

Use the following command on CLI:

splunk btool indexes list --debug your_index_name

------------
Hope I was able to help you. If so, some karma would be appreciated.

View solution in original post

diogofgm
SplunkTrust
SplunkTrust

Use the following command on CLI:

splunk btool indexes list --debug your_index_name

------------
Hope I was able to help you. If so, some karma would be appreciated.

jkamdar
Path Finder

@diogofgm thanks, I keep forgetting using btool 😞

So when I run the command you suggested, I see {default] section earlier than my specific index like, [ubunt], [rhel]. So I assume, the whatever came 1st under [default] (in my case, "frozenTimePeriodInSecs") would apply and no what I have under [ubuntu] or [rhel], correct?

Thanks for your help. 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

You should create a new question instead of continuing with solved one.

In indexes.conf and other you should look https://docs.splunk.com/Documentation/Splunk/9.4.0/Admin/Indexesconf and check what those sections means. With indexes there are global section which put some global values and also some defaults for all indexes stanzas. Per indexes part are defined attributes and values for individual index. There are some items which can only defined here and some which can defined also on global level if those are defined on both then index specific wons.

There is also app https://splunkbase.splunk.com/app/6368 which you could use inside GUI without  cli access.

0 Karma

jkamdar
Path Finder

@isoutamo Sorry, my bad. Not sure, how ended up finding that post. I will keep in mind.

0 Karma

brentrmc
Explorer

Awesome, thank you!

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...