Getting Data In

Why does btool quit with "SPLUNK_HOME must be set. Stopping."?

mykol_j
Communicator

My GoogleFu is failing me. There's a lot of btool tutorials, but I can't find this solution...

I'm on a Windows 10 system, trying to debug the effective config of it's universal client. This same message with both command prompt (cmd.exe) and with PowerShell.

I think it's apparent that it's a variable setting, somewhere, but where?

Labels (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Probably need to set environment variable SPLUNK_HOME. Try suggestion from this post

https://www.reddit.com/r/Splunk/comments/3zrobq/quick_way_to_set_environmental_variables_windows/

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

That's a typical message when you try to run btool on its own.

See the difference:

PickleRick_0-1679066496611.png

 

John_Littleton
Explorer

Check C:\Program Files\SplunkUniversalForwarder\etc\splunk-launch.conf and make sure SPLUNK_HOME is set to where you installed. Typically

SPLUNK_HOME=C:\Program Files\SplunkUniversalForwarder 

mykol_j
Communicator

Thanks! That's it, for some reason that was commented out.

# SPLUNK_HOME=C:\Program Files\SplunkUniversalForwarder

0 Karma

somesoni2
Revered Legend

Probably need to set environment variable SPLUNK_HOME. Try suggestion from this post

https://www.reddit.com/r/Splunk/comments/3zrobq/quick_way_to_set_environmental_variables_windows/

Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...