Btool Scripted Inputs for Splunk
Overview
Details
all instances of that file (default/local, system/apps) have been merged.
The btool app ingests configuration file contents on a schedule allowing you to watch for changes, find instances in
your deployment with configurations that don't match, and get your btool fix without having to hit the command line.
btool
btool provides a scripted input that indexes configuration file introspection for your Splunk instance.
Scripted inputs
btool.sh
btool.sh configuration_file [splunk_home] [sudo_user]
Runs $splunk_home/bin/splunk btool $configuration_file --debug, sudoing as the $sudo_user if any.
splunk_home defaults to $SPLUNK_HOME.
If you are running the btool script from one splunk instance against another, then you need to specify splunk_home.
You'll also want to set a sudo_user (and configure sudoers appropriately) if the foreign splunk instance runs as a
different user than the calling splunk instance.
Update on change
Starting with version 2.0.0, btool will only index a configuration if there has been a change in output since the last run, or if 24 hours have passed since the last change. This means you can run btool frequently without wasting your license, and that you can always get a complete configuration if you search over the last 24h.
Props
The following fields are extracted * app_folder (apps, master-apps, slave-apps) * app (app folder or "system") * conf (e.g. props.conf) * SPLUNK_HOME * stanza
Deployment
- Deploy to splunk instances that you want to collect configuration information from, and add local/inputs.conf to enable inputs and set index.
- Deploy to indexers receiving events for parsing and extraction props.
Credits
- Splunk Cloud SRE
- Shaun Butler
- Rob Manevski
- Russell Uman
Release Notes
Version 3.0.1
Version 1.0.1
Added icons to address appInspect failures