The ksconf command documentation is provided in the following ways:

  1. A detailed listing of each sub-command is provided in this section. This includes relevant background descriptions, typical use cases, examples, and discussion of relevant topics. An expanded descriptions of CLI arguments and their usage is provided here. If you have not used a particular command before, start here.
  2. The Command line reference provides a quick and convenient reference when the command line is unavailable. The same information is available by typing ksconf <CMD> --help. This is most helpful if you’re already familiar with a command, but need a quick refresher.


Apologies for the dust

The command docs are currently undergoing reorganization. We’re considering a topical layout rather than a per-command layout. Feedback and technical writing / organization contributions are highly welcomed.

Command Listing
Command Maturity Description
ksconf check stable Perform basic syntax and sanity checks on .conf files
ksconf combine beta Combine configuration files across multiple source directories into a single destination directory. This allows for an arbitrary number of Splunk configuration layers to coexist within a single app. Useful in both ongoing merge and one-time ad-hoc use.
ksconf diff stable Compare settings differences between two .conf files ignoring spacing and sort order
ksconf filter alpha A stanza-aware GREP tool for conf files
ksconf merge stable Merge two or more .conf files
ksconf minimize beta Minimize the target file by removing entries duplicated in the default conf(s)
ksconf package alpha Create a Splunk app .spl file from a source directory
ksconf promote beta Promote .conf settings between layers using either batch or interactive mode. Frequently this is used to promote conf changes made via the UI (stored in the local folder) to a version-controlled directory, such as default.
ksconf rest-export beta Export .conf settings as a curl script to apply to a Splunk instance later (via REST)
ksconf rest-publish alpha Publish .conf settings to a live Splunk instance via REST
ksconf snapshot alpha Snapshot .conf file directories into a JSON dump format
ksconf sort stable Sort a Splunk .conf file creating a normalized format appropriate for version control
ksconf unarchive beta Install or upgrade an existing app in a git-friendly and safe way
ksconf xml-format alpha Normalize XML view and nav files