Splunk API comparison to btool command

[rohitmaheshwari]

I am using Splunk version 7.3.2.

I am trying to find the runtime input configuration on a Splunk heavy forwarder using Rest API endpoint.
I have noticed a difference in results when accessing the input configuration on a heavy forwarder using btool in comparison to Splunk API endpoint.
Some of the monitoring input stanzas that appear on the Splunk instance when using btool are not part of the API call results.

Rest API Call:
The Rest API call uses the ‘GET’ method to retrieve the configured inputs from the endpoint ‘https://somethingishere:8089/services/data/inputs/monitor’.
The btool command:
Command used for ‘btool ‘ and filtered on the keyword syslog:
./splunk btool inputs list

Is there an endpoint to capture the current running monitor input configurations?? ..or another way of doing this.

[richgalloway]

Recall that btool shows the contents of the config files, which is not always what Splunk is currently running. Output of btool is what Splunk will run the next time it restarts.

The endpoint for capturing currently monitored inputs is what you already use - services/data/inputs/monitor.

There is also the CLI command splunk list monitor.

[rohitmaheshwari]

So, if in case I have a monitor stanza which monitors a file [monitor:///abc/syslog/xyz/*.log] and this monitor is enabled as in if there was a .log file present under the xyz directory splunk would be monitoring this file.

This monitor shows up in the btool as this is the run time config that is currently running on the instance.

This monitor should also show up in the rest query..I am hoping to see this config using rest calls.

[richgalloway]

Run the CLI command I mentioned. It will tell you which files are being monitored.

[gjanders]

"This monitor shows up in the btool as this is the run time config that is currently running on the instance.
"

That is not correct, btool shows the filesystem level configuration, not the currently active configuration.
Currently active configuration you can find via REST endpoints

If you are unsure which endpoint either check the REST API docs or try Config Quest