常用的Splunk命令

查看版本

./splunk version

首次启动
./splunk start --accept-license

开机自启动
./splunk enable boot-start

状态、启动、停止、重启
./splunk status|start|stop|restart

SSL配置
./splunk enable web-ssl
./splunk disable web-ssl

查看进程
ps -ef | grep splunk

关闭/开启splunk服务
net stop splunkd
net start splunkd

查看/更改守护进程端口
./splunk show splunkd_port
./splunk set splunkd-port xxxx

查看/更改web服务端口
./splunk show web_port
./splunk set web-port xxxx

查看/添加监听
./splunk display listen
./splunk enable listen 9998

修改服务器名
./splunk set servername mysplunk
修改后需要重启splunk

修改主机名
./splunk set default-hostname yzdy

修改端口号
./splunk set splunkd-port 8090
./splunk set web-port 8001

修改索引默认位置
索引默认位置:/opt/splunk/var/lib/splunk
可以通过配置文件进行修改
mkdir /quentin/splunk/
splunk stop
cp -rp /opt/splunk/var/lib/splunk/* /quentin/splunk/
vi /opt/splunk/etc/splunk-launch.conf
SPLUNK_DB=/quentin/splunk
splunk start

查看是否处于开机自启状态
systemctl is-enabled splunk

查看/创建/删除索引列表
./splunk list index
./splunk add index myindex
./splunk remove index myindex

查看索引存储目录
./splunk show datastore-dir

添加/修改/删除用户
./splunk add user yzdy -password “Qmrg030351” -full-name “New User” -role User
./splunk edit user yzdy -password “quentin123”
./splunk remove user yzdy

添加/删除/罗列监控器
./splunk add monitor xxx
./splunk remove monitor xxx
./splunk list monitor

添加/删除/罗列转发器
./splunk add forward-server 192.168.1.123:9997
./splunk remove forward-server 192.168.1.123:9997
./splunk list forward-server

卸载
rm -rf /opt/splunk
rm -rf /opt/splunkforward