This documentation does not apply to the most recent version of Splunk.
This documentation applies to the following versions of Splunk: 3.2 , 3.2.1 , 3.2.2 , 3.2.3 , 3.2.4 , 3.2.5 , 3.2.6
When you configure inputs, you may want to know what specific files Splunk will read prior to starting Splunk for indexing. This is especially true when configuring whitelisting/blacklisting rules. Splunk includes a listtails utility which reads in the configuration of inputs.conf in all bundles, scans your directories and shows you the exact list of files what Splunk will tail when you restart. This allows you to make changes to inputs.conf and verify if the blacklist/whitelist filtering is correct.
To use the listtails utility:
1. Navigate to $SPLUNK_HOME/bin/.
2. Run the command ./splunk cmd listtails.