Getting Data In

Why does btool quit with "SPLUNK_HOME must be set. Stopping."?

mykol_j
Communicator

My GoogleFu is failing me. There's a lot of btool tutorials, but I can't find this solution...

I'm on a Windows 10 system, trying to debug the effective config of it's universal client. This same message with both command prompt (cmd.exe) and with PowerShell.

I think it's apparent that it's a variable setting, somewhere, but where?

Labels (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Probably need to set environment variable SPLUNK_HOME. Try suggestion from this post

https://www.reddit.com/r/Splunk/comments/3zrobq/quick_way_to_set_environmental_variables_windows/

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

That's a typical message when you try to run btool on its own.

See the difference:

PickleRick_0-1679066496611.png

 

John_Littleton
Explorer

Check C:\Program Files\SplunkUniversalForwarder\etc\splunk-launch.conf and make sure SPLUNK_HOME is set to where you installed. Typically

SPLUNK_HOME=C:\Program Files\SplunkUniversalForwarder 

mykol_j
Communicator

Thanks! That's it, for some reason that was commented out.

# SPLUNK_HOME=C:\Program Files\SplunkUniversalForwarder

0 Karma

somesoni2
Revered Legend

Probably need to set environment variable SPLUNK_HOME. Try suggestion from this post

https://www.reddit.com/r/Splunk/comments/3zrobq/quick_way_to_set_environmental_variables_windows/

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...