Splunk Search

Instead of running ./splunk start or restart out of the /opt/splunk/bin directory, does anyone know how to add an alias in .bashrc?

JScordo
Path Finder

Instead of having to run ./splunk start or ./splunk restart out of the /opt/splunk/bin directory, does anyone have any tricks for adding an alias in .bashrc to simplify this?

1 Solution

PGrantham
Path Finder

I believe it's best practice to start and restart Splunk with sudo /etc/init.d/splunk start/restart, which is generated by running /opt/splunk/bin/splunk enable boot-start. This way you ensure that the Splunk process is always started using the right user with the right permissions.

As for simplifying the command with an alias, all you have to do is edit your ~/.bashrc or ~/.bash_profile and add something along the lines of alias splunk-start="/etc/init.d/splunk start".

Hope that helps.

Edit:

It just occurred to me that you may want to pass an argument to your alias (in which case you may want to directly call /opt/splunk/bin/splunk if it's something other than start/restart/stop that you're trying to run. In that case you could use something like:
alias mysplunk="/opt/splunk/bin/splunk \$@"

Then you could run commands like mysplunk version

Also, don't forget to run source ~/.bashrc after you add your alias.

View solution in original post

PGrantham
Path Finder

I believe it's best practice to start and restart Splunk with sudo /etc/init.d/splunk start/restart, which is generated by running /opt/splunk/bin/splunk enable boot-start. This way you ensure that the Splunk process is always started using the right user with the right permissions.

As for simplifying the command with an alias, all you have to do is edit your ~/.bashrc or ~/.bash_profile and add something along the lines of alias splunk-start="/etc/init.d/splunk start".

Hope that helps.

Edit:

It just occurred to me that you may want to pass an argument to your alias (in which case you may want to directly call /opt/splunk/bin/splunk if it's something other than start/restart/stop that you're trying to run. In that case you could use something like:
alias mysplunk="/opt/splunk/bin/splunk \$@"

Then you could run commands like mysplunk version

Also, don't forget to run source ~/.bashrc after you add your alias.

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!