splunk diag

[amurleopard]

Usage: splunk diag [options]

Options:
  -h, --help            show this help message and exit
  --nologin             override any use of REST logins by components/apps
  --exclude=pattern     glob-style file pattern to exclude (repeatable)
  --uri=url             url of a management port of a remote splunk install
                        from which to collect a diag.

  Component Selection:
    These switches select which categories of information should be
    collected.  The current components available are: index_files,
    index_listing, dispatch, etc, log, pool, searchpeers, consensus,
    conf_replication_summary, rest, kvstore, file_validate

    --collect=list      Declare an arbitrary set of components to gather, as a
                        comma-separated list, overriding any prior choices
    --enable=component_name
                        Add a component to the work list
    --disable=component_name
                        Remove a component from the work list

  Level of Detail:
    These switches cause diag to gather data categories with lesser or
    greater thoroughness.

    --include-lookups   Include lookup files in the etc & pooling components
                        [default: do not gather]
    --all-dumps=bool    get every crash .dmp file, opposed to default of a
                        more useful subset
    --index-files=level
                        Index data file gathering level: manifests, or full
                        (meaning manifests + metadata files) [default:
                        manifests]
    --index-listing=level
                        Index directory listing level: light (hot buckets
                        only), or full (meaning all index buckets) [default:
                        light]
    --etc-filesize-limit=size
                        do not gather files in $SPLUNK_HOME/etc larger than
                        this. (accepts values like 5b, 20MB, 2GB, if no units
                        assumes kb), 0 disables this filter [default: 10MB]
    --log-age=days      log age to gather: log files over this many days old
                        are not included, 0 disables this filter [default: 60]
    --log-filesize-limit=size
                        fully gather files in $SPLUNK_HOME/var/log smaller
                        than this size.  For log files larger than this size,
                        gather only this many bytes from the end of the file
                        (capture truncated trailing bytes). [default: 1GB]

  Output:
    These control how diag writes out the result.

    --stdout            Write an uncompressed tar to standard out.  Implies no
                        progress messages.
    --diag-name=name, --basename=name
                        Override diag's default behavior of autoselecting its
                        name, use this name instead.
    --statusfile=filename
                        Write progress messages to a file specified by the
                        given path. Useful with --stdout.
    --debug             Print debug output

  Upload:
    Flags to control uploading files  Ex: splunk diag --upload

    --upload            Generate a diag and upload the result to splunk.com
    --upload-file=filename
                        Instead of generating a diag, just upload a file
    --case-number=case-number
                        Case number to attach to, e.g. 200500
    --upload-user=UPLOAD_USER
                        splunk.com username to use for uploading
    --upload-password=UPLOAD_PASSWORD
                        splunk.com password to use for uploading
    --upload-description=UPLOAD_DESCRIPTION
                        description of file upload for Splunk support
    --firstchunk=chunk-number
                        For resuming upload of a multi-part upload; select the
                        first chunk to send