Where to find KVStore - Collections.conf in Splunk ITSI?

[PowerPacked]

Hi Guys

Where can we find KV Store - collections.conf in Splunk ITSI?

Our ITSI was on search head cluster & I don't see the storage/collections folder in SA-ITOA folder on search head?

Thanks

[muebel · Accepted solution]

Hi PowerPacked,

For this and other configuration scrutiny issues, btool will usually help.

For instance:

$SPLUNK_HOME/bin/splunk btool --debug collections list

Will give you a list of all the current configuration rolled up from all the available collections.conf files, with the --debug flag giving you the path to the config file.

You can pipe the list to less and search there for the collection in question, or otherwise redirect to a text file and search that way.

Please let me know if this answered your question! 😄