View server class configuration

Use the server class configuration viewer in agent management to inspect the configuration that a server class applies and review the effective serverclass.conf settings resolved by btool.

One of the files that agent management is configured with is the serverclass.conf file. Like other Splunk Enterprise configuration files, multiple copies of serverclass.conf can exist across different locations on a Splunk instance, such as default, app, and local directories. The Splunk platform merges all of these files into a single configuration using a defined precedence order. This layered approach is flexible and powerful for managing complex environments, but it can make it difficult to determine where a specific setting comes from when configuration issues arise.

The standard tool for resolving this problem is btool, which shows the final merged configuration and identifies the source file for each setting. However, btool has the following limitations:

  • It requires SSH access to the Splunk host, which might not be available to all administrators.
  • It runs in a terminal and produces raw text output that can be difficult to interpret at a glance, especially in environments with many server classes.

The server class configuration viewer addresses both of these limitations. It surfaces the same btool output directly in the agent management UI in a structured, readable format. You can review the effective configuration from your browser without connecting to the host over SSH, and the viewer presents the information in a way that makes it easier to identify settings, trace their origins, and spot issues.

Because the server class configuration viewer relies on btool, which reads from disk, the results reflect the current state of the configuration files on disk. If you edit a configuration file but don't reload the agent management configuration, the viewer might show settings that differ from what the Splunk platform is actively using in memory. After you reload the configuration, the Splunk platform re-reads the files from disk and updates its in-memory state, so the viewer and the running configuration are back in sync.

Where to access the server class configuration viewer

The server class configuration viewer is available in two locations, each showing a different scope of the effective configuration: