The Config Labyrinth • Room 2

The btool Command

btool is a critical troubleshooting tool that shows the merged, effective configuration for any .conf file. It simulates Splunk's configuration layering process.

Use it when you can't figure out why a setting isn't taking effect — btool will show you exactly what value is active and which file it came from.

The --debug flag is especially useful as it shows the file path where each setting originates.

Check effective props.conf

./splunk btool props list --debug
/opt/splunk/etc/system/local/props.conf
  [source::syslog]
  SHOULD_LINEMERGE = false

Check a specific stanza

./splunk btool inputs list monitor:///var/log/syslog --debug

Knowledge Check

Prove your understanding to clear the room (Rewards XP)

Complete the btool command to check the effective inputs.conf with debug output:

./splunk list --