btool returns partial information (permissions issue?)

[mfeeny1]

Hi.

Recently I ran btool to see just what stanzas were being honored in various inputs.conf files. My command was:

./splunk cmd btool inputs list

The response "looked" fine, but I later realized that config stanzas from certain inputs.conf files were omitted from the response.

Ultimately, I determined that any config files in folders that I did not have permission to read, were ignored by btool.

So, my questions...

1) Is this the way it is INTENDED to work?

2) If so, shouldn't btool at least send back a message notifying me that the results are incomplete???

This cost me a lot of time and head scratchin...

thx,
mfeeny1

[Drainy]

Well, if you don't have permission to read them as you run ./splunk btool then by definition Splunk wouldn't be able to read them if you started it so the results would maintain parity.

Run a cron job on the folders to change them all to the correct permissions or ensure you have access to the files. Splunk wouldn't really be able to tell you they are incomplete results as it can't read the files and so probably didn't read them in to begin with. Although I must say its oddly a problem I've not come across before, I normally hit all manner of permissions issues in my travels too. Probably one to look out for.

Oh, also if you stick --debug to the end of your command it will prepend the output of each line with the app it relates to, useful for debugging in general for to confirm this sort of problem.