Monitoring Splunk
Highlighted

How to run btool as REST command or via Search GUI?

Super Champion

We were looking to run btool on requirement basis for configs across whole of splunk cluster. It is not feasible to run via cmd line on individual servers. I had a plan to write it as an app and share it across all tiers, but just wanted to check if

  1. any REST endpoints for btool? (currently no mention in splunk docs)
  2. Can btool be run as an SPL ? Any hint/ideas would be welcome.

(I'm aware of https://answers.splunk.com/answers/694707/is-there-a-way-to-run-cmd-btool-check-via-rest.html , but that's same effort as writing an app across all tiers)

0 Karma
Highlighted

Re: How to run btool as REST command or via Search GUI?

SplunkTrust
SplunkTrust

Hi @koshyk

I am pretty sure there is no rest api to get the output of btool. I wrote an app that runs btool on a servers and saves it to a file (it then commits the files to a git repository). you could pick apart my code to do what you want. The app is here https://splunkbase.splunk.com/app/4182/#/overview and here is the lines of code you can use: https://github.com/ChrisYounger/git_for_splunk/blob/master/bin/input_module_gitforsplunk.py#L51

Hope you find this helpful

Highlighted

Re: How to run btool as REST command or via Search GUI?

Super Champion

Much appreciated. Upvoted
I was thinking of similar approach as an app myself, as I was thinking of making it more simple scripted input based approach. But quite painful for us to get into all tiers of huge splunk environment.

Hopefully will wait for any other ideas and will accept in few days.

0 Karma
Highlighted

Re: How to run btool as REST command or via Search GUI?

Splunk Employee
Splunk Employee

There is no btool endpoint, however you can access all of the configurations on the machine via the conf-file endpoints..

https://servername:mgmt/services/configs/conf-{file}

So you can do https://localhost:8089/services/configs/conf-props or https://localhost:8089/services/configs/conf-server.

Additionally you can do this via SPL..

| rest  splunk_server=local /services/configs/conf-props | transpose

If you do this in a distributed environment, be aware of you peers and adjust the splunk_server= to the servers you want to collect the configs from.

Highlighted

Re: How to run btool as REST command or via Search GUI?

Super Champion

Also a great idea. But anyway to ensure the [stanza] can be attached to each item?

0 Karma
Highlighted

Re: How to run btool as REST command or via Search GUI?

Splunk Employee
Splunk Employee

What do you mean to each item?

0 Karma
Highlighted

Re: How to run btool as REST command or via Search GUI?

Communicator

The configuration errors are being recorded in splunkd_stdout.log with "Invalid key in stanza" during server restart. May be worth of getting this information from this log instead of running rest command.

0 Karma