How can I use btool to find where a specific index was created?

[brentrmc]

I've been tasked with using btool (in debug mode) to find where the settings for the “onboarding” index was written by the GUI, and can't seem to figure out exactly how to do so. Any help is much appreciated!

[sohailmohammed]

Plus you can try out Admin Little Helpers app that will give you btool access from GUI

[sohailmohammed]

/SplunkHOME/bin/Splunk btool indexes list --debug | grep your_index_name

[diogofgm · Accepted solution]

Use the following command on CLI:

splunk btool indexes list --debug your_index_name

[jkamdar]

@diogofgm thanks, I keep forgetting using btool 😞

So when I run the command you suggested, I see {default] section earlier than my specific index like, [ubunt], [rhel]. So I assume, the whatever came 1st under [default] (in my case, "frozenTimePeriodInSecs") would apply and no what I have under [ubuntu] or [rhel], correct?

Thanks for your help. 

[isoutamo]

You should create a new question instead of continuing with solved one.

In indexes.conf and other you should look https://docs.splunk.com/Documentation/Splunk/9.4.0/Admin/Indexesconf and check what those sections means. With indexes there are global section which put some global values and also some defaults for all indexes stanzas. Per indexes part are defined attributes and values for individual index. There are some items which can only defined here and some which can defined also on global level if those are defined on both then index specific wons.

There is also app https://splunkbase.splunk.com/app/6368 which you could use inside GUI without  cli access.

[jkamdar]

@isoutamo Sorry, my bad. Not sure, how ended up finding that post. I will keep in mind.

[brentrmc]

Awesome, thank you!