Splunk® Enterprise

Admin Manual

Acrobat logo Download manual as PDF

Splunk Enterprise version 8.1 will no longer be supported as of April 19, 2023. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Use the CLI to administer a remote Splunk Enterprise instance

You can use the uri parameter with any CLI command to send that command to another Splunk Enterprise instance and view the results on your local server.

This topic discusses:

  • Syntax for using the uri parameter.
  • CLI commands that you cannot use remotely.

Note: Remote CLI access is disabled by default for the admin user until you have changed its default password.

Enable remote access

If you are running Splunk Free (which has no login credentials), remote access is disabled by default until you've edited the [general] stanza of $SPLUNK_HOME/etc/system/local/server.conf and set the value:


Note: The add oneshot command works on local instances but cannot be used remotely.

For more information about editing configuration files, refer to About configuration files in this manual.

Send CLI commands to a remote server

The general syntax for using the uri parameter with any CLI command is:

./splunk command object [-parameter <value>]... -uri <specified-server>

The uri value, specified-server is formatted as:


Also, the name_of_server can be the fully resolved domain name or the IP address of the remote Splunk Enterprise instance.

Important: This uri value is the mgmtHostPort value that you defined in web.conf on the remote Splunk Enterprise instance. For more information, see the web.conf reference in this manual.

For general information about the CLI, see About the CLI and Get help with the CLI in this manual.

Search a remote instance

The following example returns search results from the remote "splunkserver".

./splunk search "host=fflanda error 404 *.gif" -uri https://splunkserver:8089

For details on syntax for searching using the CLI, refer to About CLI searches in the Search Reference Manual.

View apps installed on a remote instance

The following example returns the list of apps that are installed on the remote "splunkserver".

./splunk display app -uri https://splunkserver:8089

Change your default URI value

You can set a default URI value using the SPLUNK_URI environment variable. If you change this value to be the URI of the remote server, you do not need to include the uri parameter each time you want to access that remote server.

To change the value of SPLUNK_URI, type either:

$ export SPLUNK_URI=[http|https]://name_of_server:management_port     # For Unix shells
C:\> set SPLUNK_URI=[http|https]://name_of_server:management_port     # For Windows shell

For the examples above, you can change your SPLUNK_URI value by typing:

$ export SPLUNK_URI=https://splunkserver:8089

CLI commands you cannot run remotely

You can run most CLI commands remotely, with a few exceptions.

You cannot remotely run commands that control the server. These server control commands include:

  • start, stop, restart
  • status, version

In addition, you cannot run these commands remotely:

  • add, edit, list, remove search-server
  • add oneshot

You can view all CLI commands by accessing the CLI help reference. See Get help with the CLI in this manual.

Last modified on 05 December, 2022
Administrative CLI commands
Customize the CLI login banner

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters