Malcolm McRoberts's List: Splunk

Use the CLI

To use Splunk's CLI, navigate to the $SPLUNK_HOME/bin/ directory and use the ./splunk command.  

Important: You must stop Splunk before you edit the properties of an existing index. You do not need to stop Splunk to create a new index.  

To add or edit a new index called "fflanda" using the CLI: 

./splunk [add|edit] index fflanda 

Note: Index names must consist of only numbers, letters, periods, underscores, and hyphens. They cannot begin with an underscore or hyphen.  

If you do not want to use the default path for your new index, you can use parameters to specify a new location: 

./splunk add index foo -homePath /your/path/foo/db -coldPath /your/path/foo/colddb -thawedPath /your/path/foo/thawedDb 

You must restart Splunk when you create a new index or edit the properties of an existing index.