Splank

CLI tool for querying Splunk logs.

Install

uv tool install splank

Setup

splank init

This creates ~/.config/splank/credentials.toml with your Splunk credentials.

To add a single profile without opening an editor, pass a name (and optionally a host) instead:

splank init qa mystack   # bare stack names expand to <name>.splunkcloud.com
splank init qa splunk-qa.example.com

This runs a short wizard (token only — it prompts just for the token), tests the connection before saving, and appends the profile to your existing credentials file (creating it if needed). It offers to overwrite if the name already exists, and to set the new profile as default_profile.

Configuration

The credentials file supports multiple profiles. Each profile authenticates either with a Splunk auth token (HTTP Authorization: Bearer …) or with username + password — set one or the other:

default_profile = "prod"

[profiles.prod]
host = "splunk.example.com"
port = 8089
token = "your-token-here"
verify_ssl = true

[profiles.qa]
host = "splunk-qa.example.com"
port = 8089
username = "admin"
password = "changeme"
verify_ssl = true

Usage

# Search (uses default profile)
splank search 'index=main Level=ERROR' -m 10

# Search using specific profile
splank -p qa search 'index=main Level=ERROR'

# Paste a Splunk web UI URL directly — query and time range are extracted
splank search 'https://splunk.example.com/en-US/app/search/search?q=search%20index%3Dmain&earliest=-30d%40d&latest=now'

# Discover indexes
splank discover 'web*'

# Discover with field info
splank discover 'app-*' --fields -o DISCOVERY.md

# Manage jobs
splank jobs
splank clear

Commands

• init - Create credentials file, or init <name> [host] to add one profile via a short token-only wizard
• search - Execute SPL query
• discover - Discover available indexes
• jobs - List search jobs
• clear - Clear my search jobs

Search Options

splank search 'index=main Level=ERROR' [options]

By default, internal Splunk fields (_bkt, _cd, _indextime, _serial, _si, _sourcetype, _subsecond) are hidden. Use --internal to show them.

The --zoom flag is useful when log lines contain JSON - it extracts and parses the JSON from _raw, outputs as toon format (compact and human-readable), and ignores Splunk metadata.

Global Options

• -p, --profile - Splunk profile to use (e.g., 'qa', 'prod')
• -V, --version - Show version