CLI admin commands

CLI admin commands

This topic contains information on using administrative commands via the Splunk CLI.

• For more general information, see "Get help with the CLI".
• For details on syntax for searching using the CLI, refer to "About CLI searches" in the Search Reference Manual.

  Splunk CLI command syntax: 

    ./splunk [command] [object] [-parameter <value>]...

    * Some commands don't require an object or parameters.
    * Some commands have a default parameter that can be specified by its 
      value alone.

  Commands and objects:

    * A command is an action that you can perform.
    * An object is something you perform an action on. 

  Supported commands and objects:

    [command]             [objects]

    add                   [exec|forward-server|index|licenser-pools|licenses|
                          monitor|oneshot|saved-search|search-server|tcp|udp|user]

    anonymize             source

    clean                 [eventdata|globaldata|userdata|all]

    create                app
 
    disable               [app|deploy-client|deploy-server|discoverable|
                          dist-search|index|listen|local-index|boot-start|
                          webserver|web-ssl]

    edit                  [app|exec|forward-server|index|licenser-localslave|licenses|
                          monitor|saved-search|search-server|tcp|udp|user]

    enable                [app|deploy-client|deploy-server|discoverable|
                          dist-search|index|listen|local-index|boot-start|
                          webserver|web-ssl]

    display               [app|deploy-server|discoverable|dist-search|index|
                          jobs|listen|local-index|boot-start|webserver|web-ssl]

    export,import         [eventdata|userdata]

    find                  logs 

    help                  NONE

    list                  [deploy-clients|exec|forward-server|index|licenser-groups|
                          licenser-localslave|licenser-messages|licenser-pools|licenser-slaves|
                          licenser-stacks|licenses|jobs|monitor|saved-search|search-server|
                          source|sourcetype|tcp|udp|user]

    login,logout          NONE

    package               app
 
    refresh               deploy-clients
 
    reload                [auth|deploy-server]

    remove                [app|exec|forward-server|jobs|licenser-pools|licenses|
                          monitor|saved-search|search-server|source|sourcetype|tcp|udp|user]

    search                NONE

    set                   [datastore-dir|deploy-poll|default-hostname|default-index|
                          minfreemb|servername|splunkd-port|web-port]

    show                  [config|datastore-dir|deploy-poll|default-hostname|
                          default-index|jobs|minfreemb|servername|
                          splunkd-port|web-port]
 
    spool                 NONE

    start,stop,restart    [monitor|splunkd|splunkweb]

    status                [monitor|splunkd|splunkweb]

• Was this topic useful?
• Post a comment