Command line tools
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Contents
Command line tools
Caution: DO NOT use these commands without consulting Splunk support first.
cmd
btool
Cmd line modification and listing of bundles.
Syntax
Add
./splunk cmd btool application name add
Delete
./splunk cmd btool application name delete [prefix] [entry]
List
./splunk cmd btool application name list [prefix]
classify
gzdumper
listtails
locktest
locktool
./splunk cmd locktool
Usage :
lock : [-l | --lock ] [dirToLock] <timeOutSecs>
unlock [-u | --unlock ] [dirToUnlock] <timeOutSecs>
Acquires and releases locks in the same manner as splunkd. If you were to write an external script to copy db buckets in and out of indexes you should acqure locks on the db colddb and thaweddb directories as you are modifying them and release the locks when you are done.
parsetest
pcregextest
regextest
searchtest
signtool
Sign
./splunk cmd signtool [-s | --sign] [<dir to sign>]
Verify
./splunk cmd signtool [-v | --verify] [<dir to verify>]
Using logging configuration at /Applications/splunk/etc/log-cmdline.cfg.
Allows verification and signing splunk index buckets. If you have signing set up in a cold to frozen script. Signtool allows you to verify the signatures of your archives.
tsidxprobe
This will take a look at your index files (.tsidx) and verify that they meet the necessary format requirements. It should also identify any files that are potentially causing a problem
go to the $SPLUNK_HOME/bin directory. Do "source setSplunkEnv".
Then use tsidxprobe to look at each of your index files with this little script you can run from your shell (this works with bash):
- for i in `find $SPLUNK_DB | grep tsidx`; do tsidxprobe $i >> tsidxprobeout.txt; done
(If you've changed the default datastore path, then this should be in the new location.)
The file tsidxprobeout.txt will contain the results from your index files. You should be able to gzip this and attach it to an email and send it to Splunk Support.
This documentation applies to the following versions of Splunk: 3.3 , 3.3.1 , 3.3.2 , 3.3.3 , 3.3.4 , 3.4 , 3.4.1 , 3.4.2 , 3.4.3 , 3.4.5 , 3.4.6 , 3.4.8 , 3.4.9 , 3.4.10 , 3.4.11 , 3.4.12 , 3.4.13 , 3.4.14 View the Article History for its revisions.