Splunk Enterprise

Using btool to find an index in a monitor stanza

joe06031990
Communicator

Hi, 

I am trying to use btool to find an index that is used in an inputs.conf:

./splunk btool inputs list --debug | grep "indexname"

However I get nothing back, am I doing something wrong?

 

Thanks,

 

  • Joe 

 

Labels (3)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Assuming "indexname" is a placeholder for the name of index sought, then the syntax is correct.  It's possible the index name is not specified in any inputs.conf file.  Also, if the Splunk instance does not perform inputs then there may be no inputs.conf files for btool to display.

If you run Splunk on Linux and you have access to the CLI then the OS may be able to find the file.  Run this command on your Deployment Server and SHC Deployer (or standalone instance, if that's all you have).

find /opt/splunk/etc -name inputs.conf -print0 | xargs -r0 grep "indexname"

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Assuming "indexname" is a placeholder for the name of index sought, then the syntax is correct.  It's possible the index name is not specified in any inputs.conf file.  Also, if the Splunk instance does not perform inputs then there may be no inputs.conf files for btool to display.

If you run Splunk on Linux and you have access to the CLI then the OS may be able to find the file.  Run this command on your Deployment Server and SHC Deployer (or standalone instance, if that's all you have).

find /opt/splunk/etc -name inputs.conf -print0 | xargs -r0 grep "indexname"

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...