Where can we find KV Store - collections.conf in Splunk ITSI?
Our ITSI was on search head cluster & I don't see the storage/collections folder in SA-ITOA folder on search head?
For this and other configuration scrutiny issues, btool will usually help.
$SPLUNK_HOME/bin/splunk btool --debug collections list
Will give you a list of all the current configuration rolled up from all the available collections.conf files, with the --debug flag giving you the path to the config file.
You can pipe the list to less and search there for the collection in question, or otherwise redirect to a text file and search that way.
Please let me know if this answered your question! 😄
View solution in original post