It's not a bug but is easy to trip up on. The underlying stanza you're trying to find actually uses $SPLUNK_HOME as part of its path. When you specify the stanza name using btool you'll need to write it like below, i.e as the setting appears in-file, not the expanded version: ./splunk btool inputs list 'monitor://$SPLUNK_HOME/var/log/splunk' This can be a bit confusing since if you specify simply ./splunk btool inputs list Splunk/btool will automatically expand $SPLUNK_HOME to the install dir for output, to help you understand the absolute path. ... View more