You update a props.conf file while Splunk is running. You do not restart Splunk and you run this command: splunk btool props list `"-debug. What will the output be?
A.
A list of all the configurations on-disk that Splunk contains.
B.
A verbose list of all configurations as they were when splunkd started.
C.
A list of props.conf configurations as they are on-disk along with a file path from which the configuration is located.
D.
A list of the current running props.conf configurations along with a file path from which the configuration was made.
Answer is C.
See this phrase in the docs -> "The btool command simulates the merging process using the on-disk conf files and creates a report showing the merged settings."
https://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Usebtooltotroubleshootconfigurations
Yes, and right after it says "The report does not necessarily represent what's loaded in memory. If a conf file change is made that requires a service restart, the btool report shows the change even though that change isn't active."
C is the correct answer
The report does not necessarily represent what's loaded in memory. If a conf file change is made that requires a service restart, the btool report shows the change even though that change isn't active.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
giubal
Highly Voted 4 years, 1 month agodpharker
Highly Voted 3 years, 8 months agonewrose
3 years, 6 months agobobixaka
Most Recent 7 months, 1 week agoerick165
1 year, 6 months agoRedYeti
2 years, 2 months agoApis
2 years, 5 months agomalice4
3 years agoArDeKu
3 years, 2 months agoJackall
3 years, 3 months agoTony_123
3 years, 4 months agoAshton_98
3 years, 6 months agoAshton_98
3 years, 6 months ago