Using btool command

[kannu]

Using btool command i want to check all the conf file or get a list of all conf files where my xyz host entry is present . for example my host name is abc.com and in that splunk is running so using btool i need to check all conf file where entry of abc.com is present . Anyone please provide btool cmd syntax for this.

[jkat54 · Accepted solution]

since btool requires the conf file prefix, do this instead:

For Linux (bash):

 for file in 'find /opt/splunk -type f -name "*.conf"'; do echo $file; grep abc.com $file;done

For Windows (powershell):

Get-ChildItem 'C:\Program Files\Splunk' -Recurse -ErrorAction SilentlyContinue | Where-Object {$_.Name -ilike "*.conf"} | Foreach-Object {Write-Host $_.FullName; Get-Content $_.FullName | Select-String -Pattern abc.com}

Remove "-ErrorAction SilentlyContinue" if you'd like to get permission denied errors on files your user doesnt have access to.

Also, modify the paths as needed. Your Splunk might be installed in different locations.

[kannu]

Hi jkat54,

I need to check in all configrations file only, Btool will help .
Please provide btool expression.

And thank you for the quick reply 🙂

[jkat54]

Again, btool will not check in ALL configs.

Syntax is as follows

./splunk btool <configFileName> list --debug

You cannot use a wildcard like this:

./splunk btool * list --debug

It doesn't work. So I have provided you with how to do what you want (not using btool).

[adonio]

is the hostname is a splunk instance?
if not, why would a hostname will be in your .conf files?
i think that the btool command has to identify a .conf file (and an app if needed) but can not be ran "global" per-se
with that being said, you can ran the command :

./splunk cmd btool <conf_file_prefix> list | grep abc.com

hope it helps a little

[kannu]

Hi adonio ,

thank you for the quick reply

actually yes that hostname is running the splunk instance and currently working as indexer for my distributed env setup

[adonio]

@jkat54 provided you a valid answer imho