Troubleshoot configurations with btool
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Troubleshoot configurations with btool
Splunk's configuration file system supports many overlapping configuration files in many different locations. How these configuration files interact with and take precedence over one another is described in "Configuration file precedence" in this manual. This flexibility can occasionally make it hard to figure out exactly which configuration value Splunk is using.
To help you out, Splunk provides btool. This is a command line tool that can help you troubleshoot configuration file issues or just see what values are being used by your Splunk installation.
You can run btool for any app in your Splunk installation. It will list all the configuration values in use by that app for a given configuration file.
To run btool, go to $SPLUNK_HOME/bin and type:
./splunk cmd btool --app=<app_name> <conf_file_prefix> list
where <app_name> is the name of the app you want to see the configurations for, and <conf_file_prefix> is the name of the configuration file you're interested in (minus the .conf extension). The list literal specifies that you want to list the options. You can also use btool to change configuration files, but Splunk does not recommend you use it that way without first consulting with the Splunk Support team.
For example, if you want to know what configuration options are being used in props.conf by the Search app, specify the Search app and props.conf in your btool command like so:
./splunk cmd btool --app=Search props list
This returns a list of the props.conf settings currently being used for the Search app.
You can save this list to a file and examine it.
Another thing you can do with btool is find out from which specific app Splunk is pulling its configuration parameters for a given configuration file. To do this, add the --debug flag to btool like this:
./splunk cmd btool [props] list --debug
Note: btool is not tested by Splunk and is not officially supported or guaranteed. That said, it's what our Support team uses when trying to troubleshoot your issues.
For information on btool syntax, look here.
This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 View the Article History for its revisions.