Splunk® Enterprise

Distributed Deployment Manual

Download manual as PDF

Splunk Enterprise version 5.0 reached its End of Life on December 1, 2017. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Supported CLI commands

The universal forwarder supports a subset of objects for use in CLI commands. Certain objects valid in full Splunk, like index (as in add index), make no sense in the context of the universal forwarder.

Commands act upon objects. If you type an invalid command/object combination, the universal forwarder will return an error message.

Valid CLI objects

The universal forwarder supports all CLI commands for these objects:


Note: A few commands, such as start and stop can be run without an object. A command with no object is also valid for the universal forwarder.

A brief introduction to CLI syntax

The general syntax for a CLI command is:

./splunk <command> [<object>] [[-<parameter>] <value>]...

As described above, it's the object that determines whether a command is valid in the universal forwarder. For example, the above list includes the monitor object. Therefore, the add monitor and edit monitor command/object combinations are both valid. For more information on the monitor object, see "Use the CLI to monitor files and directories" in the Getting Data In manual.

For more details on using the CLI in general, see the "Use Splunk's command line interface" chapter in the Admin manual. In particular, the topic "CLI admin commands" provides details on CLI syntax, including a list of all commands supported by full Splunk and the objects they can act upon.

Migrate a *nix light forwarder
Deploy a heavy or light forwarder

This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18


Csowers - "config" is an object, not a command. Commands act on objects. The list specifies which objects are valid for universal forwarders. I've updated the topic to provide a clearer explanation of CLI syntax, as well as pointers to where you can go to get more information on the commands that act upon the listed objects.

Sgoodman, Splunker
June 27, 2012

Are you sure this documentation is up-to-date? These commands don't seem to work:<br /><br />C:\Program Files\SplunkUniversalForwarder\bin>splunk config<br />Command error: 'config' is not a valid command. Please run 'splunk help' to see<br /> the valid commands.

June 26, 2012

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters