Monitoring Splunk

btool returns partial information (permissions issue?)

mfeeny1
Path Finder

Hi.

Recently I ran btool to see just what stanzas were being honored in various inputs.conf files. My command was:

./splunk cmd btool inputs list

The response "looked" fine, but I later realized that config stanzas from certain inputs.conf files were omitted from the response.

Ultimately, I determined that any config files in folders that I did not have permission to read, were ignored by btool.

So, my questions...

1) Is this the way it is INTENDED to work?

2) If so, shouldn't btool at least send back a message notifying me that the results are incomplete???

This cost me a lot of time and head scratchin...

thx,
mfeeny1

Tags (1)
0 Karma

Drainy
Champion

Well, if you don't have permission to read them as you run ./splunk btool then by definition Splunk wouldn't be able to read them if you started it so the results would maintain parity.

Run a cron job on the folders to change them all to the correct permissions or ensure you have access to the files. Splunk wouldn't really be able to tell you they are incomplete results as it can't read the files and so probably didn't read them in to begin with. Although I must say its oddly a problem I've not come across before, I normally hit all manner of permissions issues in my travels too. Probably one to look out for.

Oh, also if you stick --debug to the end of your command it will prepend the output of each line with the app it relates to, useful for debugging in general for to confirm this sort of problem.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...