Does anyone have a cheat sheet for btool to help newbies?
Here is my version of btool cheat sheet:
splunk btool <conf_file_prefix> <sub-cmd> <context> --debug "%search string%"
splunk show config <config file name> | grep -v "system\/default"
Step 1.
splunk btool inputs list --debug "%search string%" >> /tmp/splunk_inputs.txt
Step 2.
Import into excel using space as a separator.
Step 3. Use excel to filter feature to look for the settings
Explanation:
<conf_file_prefix>: props, inputs, outputs, transforms
<sub-cmd>: list, display, user, dir
<context>: --app=search
"%serch string%": input the search you're looking for
I'd prefer piping the command to "less" command.
Splunk documents: https://docs.splunk.com/Documentation/Splunk/8.0.5/Troubleshooting/CommandlinetoolsforusewithSupport...
https://docs.splunk.com/Documentation/Splunk/8.0.5/Troubleshooting/CommandlinetoolsforusewithSupport
External Site:
https://splunkonbigdata.com/2018/10/03/splunk-btool/
Thanks, everyone who replied. I'd consolidated the information into the top page.
Hi @youngsuh,
I didn't find a page as you would and it's a strange thing because Splunk documentation is usually very complete and structured.
Anyway, in these pages, you can find all the infos you need:
https://docs.splunk.com/Documentation/Splunk/8.0.5/Troubleshooting/CommandlinetoolsforusewithSupport
https://splunkonbigdata.com/2018/10/03/splunk-btool/
Ciao.
Giuseppe
Try
splunk btool help
I prefer to pipe btool output to
grep -v "system\/default"
to eliminate noise from the default settings.
And remember that what you got from btool is what is on disk. If/when you want to see what is running config you must use
splunk show config <config file name>
r. Ismo
Hi @youngsuh,
I didn't find a page as you would and it's a strange thing because Splunk documentation is usually very complete and structured.
Anyway, in these pages, you can find all the infos you need:
https://docs.splunk.com/Documentation/Splunk/8.0.5/Troubleshooting/CommandlinetoolsforusewithSupport
https://splunkonbigdata.com/2018/10/03/splunk-btool/
Ciao.
Giuseppe
I use the good old grep command when I needed a list of indexes referenced in all inputs on all folders ; like this:
splunk btool inputs list --debug | grep index
that is my 99% use case for btool , the aggregated list of xxxxx.conf by file --debug then filter with grep.
If you know stanza name you should add also it.
Currently there is also splunk app called Admin's little helper, which you could use to run btool from MC or splunk cloud. I strongly recommended to install and use it in any distributed environments!
Hi @youngsuh,
happy splunking!
Ciao.
Giuseppe
P.S.: Karma Points are appreciated by me and the other contributors 😉