Getting Data In

How can I use btool to find where a specific index was created?

brentrmc
Explorer

I've been tasked with using btool (in debug mode) to find where the settings for the “onboarding” index was written by the GUI, and can't seem to figure out exactly how to do so. Any help is much appreciated!

Tags (1)
0 Karma
1 Solution

diogofgm
SplunkTrust
SplunkTrust

Use the following command on CLI:

splunk btool indexes list --debug your_index_name

------------
Hope I was able to help you. If so, some karma would be appreciated.

View solution in original post

diogofgm
SplunkTrust
SplunkTrust

Use the following command on CLI:

splunk btool indexes list --debug your_index_name

------------
Hope I was able to help you. If so, some karma would be appreciated.

jkamdar
Path Finder

@diogofgm thanks, I keep forgetting using btool 😞

So when I run the command you suggested, I see {default] section earlier than my specific index like, [ubunt], [rhel]. So I assume, the whatever came 1st under [default] (in my case, "frozenTimePeriodInSecs") would apply and no what I have under [ubuntu] or [rhel], correct?

Thanks for your help. 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

You should create a new question instead of continuing with solved one.

In indexes.conf and other you should look https://docs.splunk.com/Documentation/Splunk/9.4.0/Admin/Indexesconf and check what those sections means. With indexes there are global section which put some global values and also some defaults for all indexes stanzas. Per indexes part are defined attributes and values for individual index. There are some items which can only defined here and some which can defined also on global level if those are defined on both then index specific wons.

There is also app https://splunkbase.splunk.com/app/6368 which you could use inside GUI without  cli access.

0 Karma

jkamdar
Path Finder

@isoutamo Sorry, my bad. Not sure, how ended up finding that post. I will keep in mind.

0 Karma

brentrmc
Explorer

Awesome, thank you!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...