Apparently all splunk components run the
splunk btool check upon a component restart. Is there a way to disable it especially for the forwarders? We reach quite often situations where internal customers come to up to check whether their forwarders came up fine when restarted and the
splunk btool check was invoked and threw some warnings.
AFAIK, you cannot disable btool at startup nor would I think you'd want to. Btool might find an error in the future.
Your options are to fix the forwarder configs to eliminate warnings (best) or educate your customers.
Our sales engineer said -
-- Nope, it's unskippable. And that’s a good thing; if btool fails, Splunk won't run properly so exiting before starting Splunk is the best course of action.