The Splunk CLI

You can use the Splunk CLI to monitor, configure, and execute searches on your Splunk server. Your Splunk role configuration dictates what actions (commands) you can execute. Most actions require you to be a Splunk administrator.

To access Splunk CLI, you need either:

Shell access to a Splunk server, or
Permission to access the SOAP port on a remote server.

Search your data in the Splunk CLI just as you can in Splunk Web.

Note: (If you have administrator or root privileges) To save a lot of typing, add the top level directory of your Splunk installation to your shell path. The $SPLUNK_HOME variable refers to the top level directory. Set a SPLUNK_HOME environment variable and add $SPLUNK_HOME/bin to your shell's path. The example below works for bash users who accepted the default installation location. Use the correct syntax and path for your own installation.

# export SPLUNK_HOME=/opt/splunk
# export PATH=$SPLUNK_HOME/bin:$PATH

Access help in the CLI

Find a complete CLI help reference by using the command help. Access the default CLI help page by typing the following in the command line while Splunk is running:

./splunk help

Access help on a specific CLI command, or topic by typing:

./splunk help command name | topic name

For example, access a help page about Splunk search commands:

./splunk help search-commands

Note: Notice the dash (-) between the words: "search" and "commands". This is because the Splunk CLI interprets spaces as breaks. Use dashes between multiple words for topic names that are more than one word.

CLI commands

If you have administrator privileges, you can configure and monitor your Splunk server (or servers) using the CLI. Refer to the CLI command reference in this manual for a full list of capabilities.

Note: CLI commands are NOT search commands. Search commands are arguments in the search and dispatch CLI commands.

auth and uri parameters

Use the auth and uri parameters with any CLI command.

auth

Use auth with commands that require authentication to execute. auth is useful if you need to run a command
that requires different permissions to execute than the currently logged in user has.

Note: auth must be the last parameter specified in a CLI command argument.

Syntax:

./splunk command object [-parameter value]... -auth username:password

uri

Use uri to send commands to another Splunk server.

Syntax:

./splunk command object [-parameter value]... -uri specified-server (=  [http|https]://name_of_server:port)

Note for Mac users

Mac OS X requires you to have superuser level access to run any command that accesses system files or directories. Run CLI commands using sudo or "su -" for a new shell as root. The recommended method is to use sudo. (By default the user "root" is not enabled but any administrator user can use sudo.)

Enable Splunk to start on system start-up

Enable Splunk to start at system start-up by executing the command: ./splunk enable boot-start.

Splunk automatically creates a script and configuration file in the directory: /System/Library/StartupItems. This script is run at system start, and automatically stops Splunk at system shutdown.

Note: If you are using a Mac OS, you must have root level permissions (or use sudo).

Note: You need administrator access to use sudo..

Example:
Enable Splunk to start at system start up on Mac OS using:

just the CLI::

./splunk enable boot-start

the CLI with sudo:

sudo ./splunk enable boot-start

Start live tail

You can use live tail in the CLI.

To start live tail:
1. Log into Splunk. ./splunk login

2. Use the live-tail CLI command to start live tail.

3. Type: ./splunk live-tail "your search string", where "your search string" is whatever simple search terms you want to search for (surrounded by quotes).

Previous: Find and manage saved searches | Next: Search in the CLI

Comments

For -uri we should indicate more information. The port is the management port. Generally https is used, unless explicitly turned off. Show a real example, please.
Posted by raffy on Aug 27 2008, 5:47pm