btool.exe
by Splunk
SIEM / Log Collection
Summary
Splunk btool configuration troubleshooting utility
btool.exe is the 1456th most commonly executed Windows program in EchoTrail's dataset, observed 787 times across enterprise environments. It typically runs from C:\Program Files\Splunk\bin and it is most often launched by cmd.exe.
1456th
most commonly executed Windows program
787
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Program Files\Splunk\bin50.95%
- C:\Program Files\SplunkUniversalForwarder\bin41.93%
- C:\Program Files\SUFwd\bin7.12%
Top Hashes (SHA256)
- b2dc61d57912b52a6c23937da9a873af1227473b43c63000ec083ebdb809e9b484.62%
- 303d729b79f27b5f7c2de69c26210675ed7eafaeef66f93db4dcbe729bd458dc14.36%
- dffc73a54ebd1d392866849d86e14003f4e629d57f1b1de0b48dbed2fa00c69a1.03%
Process Ancestry
Top Grandparents
- splunk.exe63.41%
- cmd.exe31.71%
- splunkd.exe4.88%
Top Parents
- cmd.exe67.56%
- splunk.exe26.46%
- python.exe5.85%
- btool.exe0.13%
Top Children
- splunkd.exe99.87%
- btool.exe0.13%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about btool.exe
Rocky answers questions about btool.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.