Commands

The ksconf command documentation is provided in the following ways:

  1. A detailed listing of each sub-command is provided in this section. This includes relevant background descriptions, typical use cases, examples, and discussion of relevant topics. An expanded descriptions of CLI arguments and their usage is provided here. If you have not used a particular command before, start here.

  2. The Command line reference provides a quick and convenient reference when the command line is unavailable. The same information is available by typing ksconf <CMD> --help. This is most helpful if you’re already familiar with a command, but need a quick refresher.

Warning

Apologies for the dust

The command docs are currently undergoing reorganization. We’re considering a topical layout rather than a per-command layout. Feedback and technical writing / organization contributions are highly welcomed.

Command Listing

Command

Maturity

Description

ksconf attr-get

beta

Get the value from a specific stanzas and attribute

ksconf attr-set

beta

Set the value of a specific stanzas and attribute

ksconf check

stable

Perform basic syntax and sanity checks on .conf files

ksconf combine

beta

Combine configuration files across multiple source directories into a single destination directory. This allows for an arbitrary number of Splunk configuration layers to coexist within a single app. Useful in both ongoing merge and one-time ad-hoc use.

ksconf diff

stable

Compare settings differences between two .conf files ignoring spacing and sort order

ksconf filter

alpha

A stanza-aware GREP tool for conf files

ksconf merge

stable

Merge two or more .conf files

ksconf minimize

beta

Minimize the target file by removing entries duplicated in the default conf(s)

ksconf package

beta

Create a Splunk app .spl file from a source directory

ksconf promote

beta

Promote .conf settings between layers using either batch or interactive mode. Frequently this is used to promote conf changes made via the UI (stored in the local folder) to a version-controlled directory, such as default.

ksconf rest-export

deprecated

Export .conf settings as a curl script to apply to a Splunk instance later (via REST)

ksconf rest-publish

alpha

Publish .conf settings to a live Splunk instance via REST

ksconf snapshot

alpha

Snapshot .conf file directories into a JSON dump format

ksconf sort

stable

Sort a Splunk .conf file creating a normalized format appropriate for version control

ksconf unarchive

beta

Install or upgrade an existing app in a git-friendly and safe way

ksconf xml-format

alpha

Normalize XML view and nav files