Knowledge Management

How to restrict btool stanzas without wildcards?

jason0
Path Finder

Hello, 

I am using splunk 9.0.0.1, and running btool to list out my index settings.  The trouble is I only want one stanza, but btool treats the stanza as a wildcard.

splunk btool --debug indexes list cisco

I get all stanza's with "cisco" in them (there are 51 of them, including "index=cisco").  how do restrict this?  I only want the "cisco" index.

--jason

Labels (1)
0 Karma
1 Solution

goncalocoelho
Path Finder

Hi,

Have you tried btool command with grep? Something like this...

splunk btool --debug indexes list | grep -A 10 "[cisco]"

-A flag will show you N lines after the string your are looking for

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

jason0
Path Finder

I admit, I had hoped there was a way to do it within btool itself, but grep is always an option...

0 Karma

goncalocoelho
Path Finder

Hi,

Have you tried btool command with grep? Something like this...

splunk btool --debug indexes list | grep -A 10 "[cisco]"

-A flag will show you N lines after the string your are looking for

 

---
If this reply helps you, Karma would be appreciated.

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...