Security

Splunk API comparison to btool command

rohitmaheshwari
Explorer

I am using Splunk version 7.3.2.

I am trying to find the runtime input configuration on a Splunk heavy forwarder using Rest API endpoint.
I have noticed a difference in results when accessing the input configuration on a heavy forwarder using btool in comparison to Splunk API endpoint.
Some of the monitoring input stanzas that appear on the Splunk instance when using btool are not part of the API call results.

Rest API Call:
The Rest API call uses the ‘GET’ method to retrieve the configured inputs from the endpoint ‘https://somethingishere:8089/services/data/inputs/monitor’.
The btool command:
Command used for ‘btool ‘ and filtered on the keyword syslog:
./splunk btool inputs list

Is there an endpoint to capture the current running monitor input configurations?? ..or another way of doing this.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Recall that btool shows the contents of the config files, which is not always what Splunk is currently running. Output of btool is what Splunk will run the next time it restarts.

The endpoint for capturing currently monitored inputs is what you already use - services/data/inputs/monitor.

There is also the CLI command splunk list monitor.

---
If this reply helps you, Karma would be appreciated.

rohitmaheshwari
Explorer

So, if in case I have a monitor stanza which monitors a file [monitor:///abc/syslog/xyz/*.log] and this monitor is enabled as in if there was a .log file present under the xyz directory splunk would be monitoring this file.

This monitor shows up in the btool as this is the run time config that is currently running on the instance.

This monitor should also show up in the rest query..I am hoping to see this config using rest calls.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Run the CLI command I mentioned. It will tell you which files are being monitored.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gjanders
SplunkTrust
SplunkTrust

"This monitor shows up in the btool as this is the run time config that is currently running on the instance.
"

That is not correct, btool shows the filesystem level configuration, not the currently active configuration.
Currently active configuration you can find via REST endpoints

If you are unsure which endpoint either check the REST API docs or try Config Quest

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...