Monitoring Splunk

btool returns partial information (permissions issue?)

mfeeny1
Path Finder

Hi.

Recently I ran btool to see just what stanzas were being honored in various inputs.conf files. My command was:

./splunk cmd btool inputs list

The response "looked" fine, but I later realized that config stanzas from certain inputs.conf files were omitted from the response.

Ultimately, I determined that any config files in folders that I did not have permission to read, were ignored by btool.

So, my questions...

1) Is this the way it is INTENDED to work?

2) If so, shouldn't btool at least send back a message notifying me that the results are incomplete???

This cost me a lot of time and head scratchin...

thx,
mfeeny1

Tags (1)
0 Karma

Drainy
Champion

Well, if you don't have permission to read them as you run ./splunk btool then by definition Splunk wouldn't be able to read them if you started it so the results would maintain parity.

Run a cron job on the folders to change them all to the correct permissions or ensure you have access to the files. Splunk wouldn't really be able to tell you they are incomplete results as it can't read the files and so probably didn't read them in to begin with. Although I must say its oddly a problem I've not come across before, I normally hit all manner of permissions issues in my travels too. Probably one to look out for.

Oh, also if you stick --debug to the end of your command it will prepend the output of each line with the app it relates to, useful for debugging in general for to confirm this sort of problem.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...