| ]]]>

| ]]]>

]]]>

]]]>

]]]>

| ]]]>

| ]]]>

]]]>

| ]]]>

]]]>

| ]]]>

edit

list list edit server-settings list edit server-settings

list edit server-settings list edit server-settings

list edit server-settings list edit server-settings list edit server-settings list list list edit server-settings list edit server-settings

list edit edit server-settings edit server-settings edit server-settings edit server-settings

{source} {source} list

list

{name} {name} edit {name} edit {name} {name} list edit edit list ]]> edit list

[-parameter ] ...]]> {category}

[-parameter ] ...]]> ]]> {pool_name} [-parameter ] ...]]> {pool_name}

[-parameter ] ...]]> =. eg: role=admin, app=search AND (NOT index=_internal), runtime>10. Possible values of type are: app, role, user, index, runtime, search_type, search_mode, search_time_range]]> 20" -action abort -schedule "every_week" -start_time "10:00" -end_time "15:00" -every_week_days "0,4,6" -user_message "The search is aborted due to long runtime"]]> [-parameter ]]]> {rule_name} [-parameter ] ...]]> {rule_name} ]]]> ]]> -workload_rule_type search_filter]]> edit {rule_name} ]]> -workload_rule_type search_filter]]> edit {rule_name} list

list

] ...]]> edit {name} list ]]> list list list list list list list ]]]> list

list ]]> Caution: Passing login credentials on the CLI is a security risk.]]> , -manual_detention on|off|on_ports_enabled]]>

create {old_master_uri} edit {master_uri} remove list

edit edit edit

edit

edit {name} list edit edit list list list list edit edit edit ] ...]]> edit

[,...] [-parameter ] ...]]> edit edit list list list list list

edit edit edit edit edit list

edit edit list ]]> edit edit edit list list

edit edit list edit edit edit edit edit list list list list list list edit list edit edit edit list edit edit edit edit list ] ...]]>

] ...]]> ] ...]]> {source} {source} list

edit edit {name} create {name} list

] ...]]> ] ...]]> {source} {source} list ] ...]]> {source} {source} list

]]> list - ]]> ]]> - ]]> ]]> {name} ]]> ]]> {name}

]... list forward-server]]> : where host and port are hostname or IP address of the indexing server and port that the indexer is listening on]]> : where host and port are hostname or IP address of the indexing server and port that the indexer is listening on]]> {hostport}

edit ] [-timeout ]]]> edit

edit edit

edit : where host and port are hostname or IP address of the deployment server to poll updates from.]]>

edit edit list

[-parameter ] ...]]> `

create

| ]]]> edit | ]]]> edit | ]]]> list

[-parameter ] ...]]> Caution: Passing login credentials on the CLI is a security risk.]]> ]]> [-parameter ] ...]]>

[-parameter ] ...]]> ]]> [-parameter ]]]>

edit {name} edit {name} list

edit {name} edit {name} list

edit {name} edit {name} list

edit {name} edit {name}

]]> edit {name} ]]> edit {name}

edit {name} edit {name}

edit {name} edit {name} list

edit {name} edit {name}

edit {name} edit {name}

] edit saved-search [-parameter ] list saved-search remove saved-search Required Parameters: name (default) name of saved search to create terms search terms to be associated with this saved search Optional Parameters: alert make the search an alert (true|false, default=false) IF alert=true, "schedule" and "threshold" are required, and "email", "attach" or "script" options are required. end_time the latest time for the search fields a list of key-value pairs to annotate the events inserted into the summary index. format pairs as key:value and separate multiple entries with a semicolon summary_index the name of the summary index where to add the results of the scheduled search start_time the earliest time for the search ttl time-to-live (in seconds) for the artifacts of the scheduled search (IF optional parameter "alert" is set to true, then the following is REQUIRED) schedule specify when the alert is run using full cron format (IF optional parameter "alert" is set to true, then AT LEAST ONE of the following is REQUIRED) email comma-separated list of email addresses to send alerts to (true|false) default=false attach specify inclusion of search results in emails (true|false) default=false script script to execute upon alert (ex: $SPLUNK_HOME/bin/myScript) workload_pool specify the name of the workload-pool for the search to run in threshold the threshold to trigger the alert action [::] = num-events,num-sources,num-hosts = any integer Complete documentation is available online at: http://docs.splunk.com/Documentation ]]>

-description -quota -slaves -stack_id ]]> -description -quota -slaves ]]> ]]>

://:]]>

-is_active 1]]> {name}

| ]... [-uri][-auth] app specify the app or namespace to run the command; for search, defaults to the Search app auth specify login credentials to execute commands that require you to be logged in owner specify the owner/user context associated with an object; if not specified, defaults to the currently logged in user uri execute a command on any specified Splunk server. Use the format: : Note: Both IPv4 and IPv6 formats are supported for specifying an IP address, for example: 127.0.0.1:80 or "[2001:db8::1]:80". By default, splunkd listens on IPv4 only. To enable IPv6 support, refer to the instructions in: http://docs.splunk.com/Documentation/Splunk/latest/Admin/ConfigureSplunkforIPv6 ]]>

]... Supported commands and objects: [command] [objects] add [exec|forward-server|index|licenser-pools|licenses|master|monitor|oneshot| saved-search|search-server|tcp|udp|user] anonymize source apply cluster-bundle clean [all|eventdata|globaldata|inputdata|userdata|kvstore|raft] cmd [btool|exporttool|importtool|locktest|locktool|parsetest|pcregextest|signtool|walklex] create app createssl NONE diag NONE disable [app|boot-start|deploy-client|deploy-server| dist-search|index|kvstore-maintenance-mode|listen|local-index|maintenance-mode|shcluster-maintenance-mode|webserver|web-ssl] display [app|boot-start|deploy-client|deploy-server| dist-search|index|jobs|listen|local-index] edit [app|cluster-config|shcluster-config|exec|index|licenser-localslave|licenses| licenser-groups|master|monitor|saved-search|search-server|tcp|udp|user] enable [app|boot-start|deploy-client|deploy-server|dist-search| index|kvstore-maintenance-mode|listen|local-index|maintenance-mode|shcluster-maintenance-mode|webserver|web-ssl] export [eventdata|userdata] find logs fsck [repair|scan|clear-bloomfilter] help NONE import userdata install app list [cluster-buckets|cluster-config|cluster-generation|cluster-peers|deploy-clients|excess-buckets| shcluster-artifacts|shcluster-config|shcluster-members| exec|forward-server|index|jobs|licenser-groups|licenser-localslave|licenser-messages| licenser-pools|licenser-slaves|licenser-stacks|licenses|master|master-info|monitor|peer-buckets|peer-info| saved-search|search-server|tcp|udp|user] login,logout NONE offline NONE package app rebalance cluster-data rebuild NONE refresh deploy-clients reload [ad|auth|deploy-server|index|listen|monitor|registry|script|tcp|udp|perfmon|wmi] remove [app|cluster-peers|excess-buckets|exec|forward-server|index|jobs|licenser-pools|licenses|master|monitor| saved-search|search-server|tcp|udp|user] rollback cluster-bundle rolling-restart cluster-peers|shcluster-members rotate splunk-secret|shcluster-splunk-secret rtsearch [app|batch|detach|earliest_time|header|id|max_time|maxout|output|preview|timeout| uri|wrap|workload_pool] search [app|batch|detach|earliest_time|header|id|index_earliest|index_latest|latest_time| max_time|maxout|output|preview|timeout|uri|wrap|workload_pool] set [datastore-dir|deploy-poll|default-hostname|default-index| minfreemb|servername|server-type|splunkd-port|web-port|kvstore-port] show [config|datastore-dir|deploy-poll|default-hostname|default-index| jobs|minfreemb|servername|splunkd-port|web-port|kvstore-port| kvstore-status] spool NONE start,stop,restart [splunkd|splunkweb] status [splunkd|splunkweb] check-integrity NONE generate-hash-files NONE validate [index|files|cluster-bundle] resync [kvstore|shcluster-replicated-config] backup [kvstore] restore [kvstore] merge-buckets [--index-name] ]]>

]... Syntax notation: * Plain text: indicate required arguments * [Text in brackets]: indicate optional arguments * Parameters always have a "-" with no space (Example: "-parameter" NOT "- parameter") * ... indicates that you can add multiple arguments]]>

|] ... edit index [-name |] ... list index export [eventdata|userdata] import userdata clean [all|eventdata|globaldata|userdata] [-f] [-index ] clean inputdata [] [-f] Parameters: (For add and edit index) name value name of the index (For clean ONLY) f forces skip of confirmation prompt (For clean eventdata ONLY) index name name of the index ]]>

] ... enable [listen|dist-search|local-index|deploy-client| deploy-server] [-parameter ] ... display [listen|dist-search|local-index|deploy-server] add [forward-server|search-server] server remove [forward-server|search-server] server list [deploy-clients|forward-server|search-server] reload deploy-server refresh deploy-clients set [deploy-poll] show [deploy-poll] Parameters: For a complete list of parameters, type "./splunk help [command|object]" to get a specific list. ]]>

] ... disable local-index [-parameter ] ... display local-index add [forward-server|search-server] server remove [forward-server|search-server] server list [forward-server|search-server] Parameters: For a complete list of parameters, type "./splunk help [command|object]" to get a specific list. ]]>

] ... edit [exec|monitor|tcp|udp] [source] [-parameter ] ... remove [monitor|tcp|udp] [source] list [monitor|tcp|udp] Required Parameter: source file, directory, scripted input, or socket to manage Optional Parameters: Type "./splunk help [command|object]" to view a complete list of parameters. ]]>

[parameters...]]]>

list [options] btool check [options]]]> ]]> :]]> ]]> :]]> ]]> :]]> ]]> :]]>

]]>

| ] show [object][] Objects: (For set ONLY) server-type change modes of server configuration files (This is an ADVANCED setting and should not be changed without consulting Splunk Support first) (For show ONLY) config show the details of a specified conf file. (NOTE: this command will only work if the file exists in the location specified by $SPLUNK_HOME/etc/system/default/conf.conf) jobs show information for the specified asynchronous search (For both set and show) datastore-dir set or show which directory is used for Splunk's datastore deploy-poll enable the deployment client and set the deployment server uri to poll default-hostname set or show the default host name used for all data inputs default-index set the default search index(es) for a given role; show default search index(es) for the role this user belongs to (command is deprecated and may be removed in the future) minfreemb set or show the minimum free disk space threshold (if free space falls below this amount Splunk stops indexing data) servername set or show the servername used in a distributed search splunkd-port change the port that the Splunk daemon (splunkd) listens on web-port change the port that Splunk Web listens on kvstore-port change the port that the Splunk KV Store listens on appserver-ports change the ports that the Splunk application server listens on (These ports are only bound to the loopback interface. Typically only one port is specified in this list) Required Parameters: Note: Both IPv4 and IPv6 formats are supported for specifying an IP address, for example: 127.0.0.1:80 or "[2001:db8::1]:80". By default, splunkd listens on IPv4 only. To enable IPv6 support, refer to the instructions in: http://docs.splunk.com/Documentation/Splunk/latest/Admin/ConfigureSplunkforIPv6 (For set ONLY) datastore-dir path to new datastore directory deploy-poll uri deployment server ip:port to poll for deployment class updates default-hostname value new host name to use default-index value one or list of indexes; if multiple, delimit each value with a comma role specify a role (admin, power, user) that can view the default index minfreemb minspace new number of megabytes servername new distributed search name for the server splunkd-port new port that splunkd should listen on web-port new port that Splunk Web should listen on kvstore-port new port that Splunk KV Store should listen on appserver-ports new comma-separated list of ports that the Splunk application server should listen on (For show ONLY) jobs the job id for the asynchronous search name the name of the conf file, without the file extension ]]>

]... validate object [-parameter ] Objects: source the source that anonymize will perform action on (For validate ONLY) index index to check for correctness Optional Parameters: For a complete list of parameters, type "./splunk help [command|object]" to get a specific list. ]]>

[parameters...]]]>

] Note: Parameters that take Boolean values support {0, false, f, no} as negatives and {1, true, t, yes} positives. Objects: Search objects are enclosed in single quotes (' ') and can be keywords, expressions, or a series of search commands. Optional Parameters: app appname specify an app context to run the search batch true indicates how to handle updates in preview mode. Defaults to false. detach true triggers an asynchronous search and displays the job id and ttl for the search. header false indicates whether to display a header in the table output mode. max_time number the length of time in seconds that a search job runs before it is finalized. Defaults to 0, which means no time limit. maxout number the maximum number of events to return or send to stdout (when exporting events). Setting this to 0 means it will output an unlimited number of events. The max allowable value is 50k. Defaults to 100. output value indicates how to display the job. Choices are: rawdata, table, csv, raw, and auto. If not specified, defaults to rawdata for non-transforming searches and table for transforming searches. preview false indicates that reporting searches should be previewed. Defaults to true. timeout number the length of time in seconds that a search job is allowed to live after running. Defaults to 0, which means the job is cancelled immediately after it is run. wrap false indicates whether to line wrap for individual lines that are longer than the terminal width. Defaults to true. workload_pool value the name of the workload-pool for the search to run in. See what search language is available for use in the CLI by using these help commands: search-fields a full list of search fields search-modifiers a full list of search modifiers search-commands a full list of usable search commands Examples: ./splunk search '*' -detach true ./splunk search 'eventtype=webaccess error' -wrap 0 ./splunk search 'eventtype=webaccess error' -detach true ]]>

[-verbose] check-rawdata-format -index [-verbose] check-rawdata-format -allindexes [-verbose] Respectively, you can choose to check the rawdata format in a specific bucket, all bucket in an index, or all buckets in all indexes. Addendum: If you need more advance bucket filtering and selection, please see: splunk cmd splunkd fsck ]]>

[-verbose] check-integrity -index [-verbose] ]]>

]]> ']]>

[-verbose] generate-hash-files -index [-verbose] ]]>

]]> ']]>

]]> of buckets in the index homePath.Use '0' to display all merged buckets found.]]>