Monitoring Splunk

Using btool command

kannu
Path Finder

Using btool command i want to check all the conf file or get a list of all conf files where my xyz host entry is present . for example my host name is abc.com and in that splunk is running so using btool i need to check all conf file where entry of abc.com is present . Anyone please provide btool cmd syntax for this.

Tags (2)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

since btool requires the conf file prefix, do this instead:

For Linux (bash):

 for file in 'find /opt/splunk -type f -name "*.conf"'; do echo $file; grep abc.com $file;done

For Windows (powershell):

Get-ChildItem 'C:\Program Files\Splunk' -Recurse -ErrorAction SilentlyContinue | Where-Object {$_.Name -ilike "*.conf"} | Foreach-Object {Write-Host $_.FullName; Get-Content $_.FullName | Select-String -Pattern abc.com}

Remove "-ErrorAction SilentlyContinue" if you'd like to get permission denied errors on files your user doesnt have access to.

Also, modify the paths as needed. Your Splunk might be installed in different locations.

View solution in original post

jkat54
SplunkTrust
SplunkTrust

since btool requires the conf file prefix, do this instead:

For Linux (bash):

 for file in 'find /opt/splunk -type f -name "*.conf"'; do echo $file; grep abc.com $file;done

For Windows (powershell):

Get-ChildItem 'C:\Program Files\Splunk' -Recurse -ErrorAction SilentlyContinue | Where-Object {$_.Name -ilike "*.conf"} | Foreach-Object {Write-Host $_.FullName; Get-Content $_.FullName | Select-String -Pattern abc.com}

Remove "-ErrorAction SilentlyContinue" if you'd like to get permission denied errors on files your user doesnt have access to.

Also, modify the paths as needed. Your Splunk might be installed in different locations.

View solution in original post

kannu
Path Finder

Hi jkat54,

I need to check in all configrations file only, Btool will help .
Please provide btool expression.

And thank you for the quick reply 🙂

0 Karma

jkat54
SplunkTrust
SplunkTrust

Again, btool will not check in ALL configs.

Syntax is as follows

./splunk btool <configFileName> list --debug

You cannot use a wildcard like this:

./splunk btool * list --debug

It doesn't work. So I have provided you with how to do what you want (not using btool).

0 Karma

adonio
SplunkTrust
SplunkTrust

is the hostname is a splunk instance?
if not, why would a hostname will be in your .conf files?
i think that the btool command has to identify a .conf file (and an app if needed) but can not be ran "global" per-se
with that being said, you can ran the command :

./splunk cmd btool <conf_file_prefix> list | grep abc.com

hope it helps a little

0 Karma

kannu
Path Finder

Hi adonio ,

thank you for the quick reply

actually yes that hostname is running the splunk instance and currently working as indexer for my distributed env setup

0 Karma

adonio
SplunkTrust
SplunkTrust

@jkat54 provided you a valid answer imho