Splunk Enterprise

Using btool to find an index in a monitor stanza

joe06031990
Communicator

Hi, 

I am trying to use btool to find an index that is used in an inputs.conf:

./splunk btool inputs list --debug | grep "indexname"

However I get nothing back, am I doing something wrong?

 

Thanks,

 

  • Joe 

 

Labels (3)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Assuming "indexname" is a placeholder for the name of index sought, then the syntax is correct.  It's possible the index name is not specified in any inputs.conf file.  Also, if the Splunk instance does not perform inputs then there may be no inputs.conf files for btool to display.

If you run Splunk on Linux and you have access to the CLI then the OS may be able to find the file.  Run this command on your Deployment Server and SHC Deployer (or standalone instance, if that's all you have).

find /opt/splunk/etc -name inputs.conf -print0 | xargs -r0 grep "indexname"

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Assuming "indexname" is a placeholder for the name of index sought, then the syntax is correct.  It's possible the index name is not specified in any inputs.conf file.  Also, if the Splunk instance does not perform inputs then there may be no inputs.conf files for btool to display.

If you run Splunk on Linux and you have access to the CLI then the OS may be able to find the file.  Run this command on your Deployment Server and SHC Deployer (or standalone instance, if that's all you have).

find /opt/splunk/etc -name inputs.conf -print0 | xargs -r0 grep "indexname"

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...