I’m the Splunk Marine; meaning I’m both a Splunker and a Marine. After five months of working at Splunk, I realized some of my core Unix and Linux skills were getting a little rusty. In a former life, I was a Linux Systems Engineer for a government agency, so it’s important to me to keep those skills sharp. One of the most important skill sets as a Unix/Linux Systems Engineer, in my opinion, is the ability to utilize a console based text editor. My editor of choice is VI, although many prefer EMACS. Many of these console based text editors are quite complicated. One of the things I do to both remember all the commands for VI and try to stay sharp in that specific skillset is to set my desktop background as a VI cheat sheet. This is especially important, as Splunk configuration files are all editable text files. With some well-developed VI skills, it makes it quite easy to configure or reconfigure your Splunk installs, especially those installs such as the Universal Forwarder, which does not have a Splunk Web UI. So here:
is the cheat sheet I use. It’s not an all-inclusive cheat sheet, but it covers about 90% of the commands that are available to you in VI. One other interesting fact is that VI is the only text editor, by default, that is built into all Unix/Linux operating systems. I hope this tidbit of information is helpful to you. Please check back soon for more Tips and Tricks from this old Jarhead.
For your convenience:
- Links to the above cheat sheet:
- Link to EMACs cheat sheet:
- Link to Splunk quick reference for RegEx: