Documentation > Splunk > Admin Manual > Use btool to troubleshoot configurations

Admin Manual

 


Welcome
What to do first
Start Splunk
Meet Splunk Web and Splunk Apps
Before you configure
Add data and configure inputs
Indexing and event processing
Timestamps
Add and manage users
Manage indexes
Define alerts
Set up backups and retention policies
Configure data security
Set up forwarding and receiving
Deploy to other Splunk instances
Set up distributed search
Manage search jobs
Use Splunk's command line interface (CLI)
Configuration file reference
Troubleshooting

Use btool to troubleshoot configurations

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Use btool to troubleshoot configurations

Splunk's configuration file system supports many overlapping configuration files in many different locations. How these configuration files interact with one another and take precedence over one another is described in "About configuration files" in this manual. Sometimes the price of this level of flexibility is that figuring out which value for which configuration option is being used in your Splunk installation can be quite complex.

Splunk provides a command line tool you can use to help troubleshoot issues with your configuration files, or just see what values are being used by your Splunk installation.

The command line tool is called btool. You can run btool for a given App in your Splunk installation, and it will list out all the configuration options that are currently in use by that App for a given configuration file.

To run btool, go to $SPLUNK_HOME/bin and type:

./splunk cmd btool --app=App_name [prefix] list

where App_name is the name of the App you want to see the configurations for and prefix is the name of the config file you're interested in without the .conf extension. list indicates that you want to list the options. So for example, if you want to know what configuration options are being used in props.conf by the Search App, you'd specify the Search App and props.conf in your btool string like so:

./splunk cmd btool --app=search props list

and would see a list of the props.conf settings currently being used for the Search App. You can see where a particular configuration line came from with:

./splunk cmd btool --app=App_name [prefix] list --debug

You can then save this list to a file and examine it.

You may also see the global system configuration by omitting the App parameter:

./splunk cmd btool [prefix] list --debug


btool supports changing configuration files as well, but Splunk does not recommend you use btool this way without discussing it with the Splunk Support team.

EXAMPLE: To list out all your inputs.conf configuration (across all apps):

./splunk cmd btool inputs list


Note: btool is not tested by Splunk and is not officially supported or guaranteed. That said, this is what our Support team uses when trying to troubleshoot your issues.

Retrieved from "http://docs.splunk.com/Documentation/Splunk/4.0.6/Admin/Troubleshootingconfigurations"

This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 , 4.0.10 , 4.0.11 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!