Knowledge Management

Where to find KVStore - Collections.conf in Splunk ITSI?

PowerPacked
Builder

Hi Guys

Where can we find KV Store - collections.conf in Splunk ITSI?

Our ITSI was on search head cluster & I don't see the storage/collections folder in SA-ITOA folder on search head?

Thanks

Tags (2)
0 Karma
1 Solution

muebel
SplunkTrust
SplunkTrust

Hi PowerPacked,

For this and other configuration scrutiny issues, btool will usually help.

For instance:

$SPLUNK_HOME/bin/splunk btool --debug collections list

Will give you a list of all the current configuration rolled up from all the available collections.conf files, with the --debug flag giving you the path to the config file.

You can pipe the list to less and search there for the collection in question, or otherwise redirect to a text file and search that way.

Please let me know if this answered your question! 😄

View solution in original post

muebel
SplunkTrust
SplunkTrust

Hi PowerPacked,

For this and other configuration scrutiny issues, btool will usually help.

For instance:

$SPLUNK_HOME/bin/splunk btool --debug collections list

Will give you a list of all the current configuration rolled up from all the available collections.conf files, with the --debug flag giving you the path to the config file.

You can pipe the list to less and search there for the collection in question, or otherwise redirect to a text file and search that way.

Please let me know if this answered your question! 😄

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...