查看版本
./splunk version
首次启动
./splunk start --accept-license
开机自启动
./splunk enable boot-start
状态、启动、停止、重启
./splunk status|start|stop|restart
SSL配置
./splunk enable web-ssl
./splunk disable web-ssl
查看进程
ps -ef | grep splunk
关闭/开启splunk服务
net stop splunkd
net start splunkd
查看/更改守护进程端口
./splunk show splunkd_port
./splunk set splunkd-port xxxx
查看/更改web服务端口
./splunk show web_port
./splunk set web-port xxxx
查看/添加监听
./splunk display listen
./splunk enable listen 9998
修改服务器名
./splunk set servername mysplunk
修改后需要重启splunk
修改主机名
./splunk set default-hostname yzdy
修改端口号
./splunk set splunkd-port 8090
./splunk set web-port 8001
修改索引默认位置
索引默认位置:/opt/splunk/var/lib/splunk
可以通过配置文件进行修改
mkdir /quentin/splunk/
splunk stop
cp -rp /opt/splunk/var/lib/splunk/* /quentin/splunk/
vi /opt/splunk/etc/splunk-launch.conf
SPLUNK_DB=/quentin/splunk
splunk start
查看是否处于开机自启状态
systemctl is-enabled splunk
查看/创建/删除索引列表
./splunk list index
./splunk add index myindex
./splunk remove index myindex
查看索引存储目录
./splunk show datastore-dir
添加/修改/删除用户
./splunk add user yzdy -password “Qmrg030351” -full-name “New User” -role User
./splunk edit user yzdy -password “quentin123”
./splunk remove user yzdy
添加/删除/罗列监控器
./splunk add monitor xxx
./splunk remove monitor xxx
./splunk list monitor
添加/删除/罗列转发器
./splunk add forward-server 192.168.1.123:9997
./splunk remove forward-server 192.168.1.123:9997
./splunk list forward-server
卸载
rm -rf /opt/splunk
rm -rf /opt/splunkforward