From
http://docs.splunk.com/Documentation/Splunk/6.2.1/Troubleshooting/CommandlinetoolsforusewithSupport
Example:
parsetest "10/11/2009 12:11:13" "syslog"
I adapted it to my current use case but can't figure out what it's trying to do
/opt/splunk/bin/splunk cmd /opt/splunk/bin/parsetest "2014-11-01 23:50:21,318" "my_test_sourcetype"
Conf is currently being modified by process 15206.
Conf is currently being modified by process 15206.
Conf is currently being modified by process 15206.
Conf is currently being modified by process 15206.
Conf is currently being modified by process 15206.
Conf is currently being modified by process 15206.
Hi splunk_zen,
if you run splunk cmd parsetest --help
you will get some options:
Usage: /opt/splunk/bin/splunkd [OPTION...]
--nodaemon causes the system not to daemonize
-c STRING override the config path
-h no longer supported
-i no longer supported
-n STRING the component name to start with
-p INT the management port Splunkd will listen on
--debug start with debug log config
Help options:
-?, --help Show this help message
--usage Display brief usage message
You maybe noticed, that is says Usage: /opt/splunk/bin/splunkd [OPTION...]
so this means the parsetest command should be used when Splunk is stopped. Running the parsetest
command will start a Splunk process with the provided options, like --debug
which will increase debug verbosity in splunkd.log
.
But I would only use it when advised by Splunk support to do so, like mentioned in the docs http://docs.splunk.com/Documentation/Splunk/6.3.3/Troubleshooting/CommandlinetoolsforusewithSupport
Hope this helps ...
cheers, MuS
Bump. Anyone with experience using bin/parsetest?