Wondering what’s next for npm?Check out our public roadmap! »


0.8.1 • Public • Published


An awesome little REPL for issuing Splunk queries


What is it?

splunkrepl is an interactive tool for issuing Splunk queries right from the terminal!


npm install -g splunkrepl

How to use it

splunkrepl works both in an interactive REPL mode and as a non-interactive executor.


  • Run "splunkrepl" at the terminal, passing in optional params of --host, --user and --pwd.

REPL Commands

All REPL commands use positional arguments.


Allows you to connect to a Splunk instance.

Argument Description
host Optional. Specifies the host to connect to. Will default to host from config.
user Optional. Specifies the user. Will default to user from config.
pwd Optional. Specifies the password. Will default to pwd from config.


  • :connect localhost admin changeme
  • :connect https://localhost:8089 admin changeme
  • :connect https://localhost:8089

Opens the Splunk Web UI and sends a query

Argument Description
query Optional. Specifies the query to send to Splunk. Will default to the last query issued.


  • :web * | head 10

Stores a command in memory using the specified key. splunkrepl allows you to store an arbitrary number of commands which you can retrieve for later use. The commands are automatically loaded on startup from the .splunkrepl file in the home directory.

Argument Description
key Required. Specifies the key. Must not contain spaces.
value Required. Specifies the value. Anything after the key will be taken verbatim

Note: The keys host,user,pwd,port and webport set the default connection parameters as well as the port to use for the :web command.


  • :set myconn :connect localhost server1 admin changeme
  • :set head10 * | head 10
  • :set main_sourcetypes * | stats count by sourcetype, source

Gets the value and immediately executes it as if the user typed it in.

Argument Description
key Required. Specifies the key to retrieve. Must not contain spaces.


Using head10 from the previous example

:get head10

will result in the query * | head 10 immediately being executed.


Lists all key/values from configuration.


Saves all commands to the .splunkrepl file. If you do not save changes they will be discarded when you exit the REPL.


  • Run "splunkrepl" at the terminal, passing in required params of --host, --user and --pwd and also passing --query

Command arguments

Argument Description
--host Splunk host to connect to including the port, ex. "https://localhost:8089"
--user Splunk user to connect with
--pwd Password for the Splunk Account
--query SPL query to immediately execute. Runs in non-interactive mode
--verbose Return as much detail as possible within each event (see below)

--json | Send all output in JSON


When the results that are returned are calculated (do not have _raw) such as from stats or table, then a table view will be displayed:


Verbose mode

By default when queries run, splunkrepl will return only _time, source, sourcetype, host and _raw (if available) fields. To get all the details specify --verbose and you will get output similar to below:



splunkrepl is licensed under the Apache License 2.0. Details can be found in the file LICENSE.

Release notes

Check the change log here




npm i splunkrepl

DownloadsWeekly Downloads






Last publish


  • avatar