What will the output be?

You update a props. conf file while Splunk is running. You do not restart Splunk and you run this command: splunk btoo1 props list ―debug .

What will the output be?
A . list of all the configurations on-disk that Splunk contains.
B . A verbose list of all configurations as they were when splunkd started.
C . A list of props. conf configurations as they are on-disk along with a file path from which the configuration is located
D . A list of the current running props, conf configurations along with a file path from which the configuration was made

View Answer

Answer: C

Explanation:

https://docs.splunk.com/Documentation/Splunk/8.0.1/Troubleshooting/Usebtooltotroubleshootconfigurations

"The btool command simulates the merging process using the on-disk conf files and creates a report showing the merged settings."

"The report does not necessarily represent what’s loaded in memory. If a conf file change is made that requires a service restart, the btool report shows the change even though that change isn’t active."