Highlights
Adds an opt-in --prepend flag (and [splunk] prepend config field) for controlling how splunk-cli wraps your SPL before submission. Default behavior is unchanged. Three modes:
| Mode | When search is added |
Notes |
|---|---|---|
pipe-only (default) |
unless input starts with | |
Historical behavior; backward compatible. |
auto |
unless input starts with | or with the search command (followed by whitespace / EOF) |
Convenient for pasting from Splunk Web. Does not detect macros that expand to a leading command — use off for that. |
off |
never | Caller supplies a complete SPL. |
Precedence: CLI flag > config file > built-in default (pipe-only).
# per-invocation
splunk-cli run --prepend auto --spl 'search index=foo | stats count'
# or persisted in ~/.config/splunk-cli/config.toml
[splunk]
prepend = "auto"Closes #4.
Internal
The auto-prepend logic moved into the new internal/spl package as a pure Wrap(spl, mode) helper with table-driven tests. The Splunk client now delegates to it instead of inlining the rule. No observable change at the default mode.
Downloads
All darwin variants are Developer ID signed and Apple-notarized. No xattr -d com.apple.quarantine workaround needed.
| Asset | Platform |
|---|---|
splunk-cli-v2.1.0-darwin-universal.zip |
macOS (Intel + Apple Silicon) |
splunk-cli-v2.1.0-darwin-amd64.zip |
macOS (Intel only) |
splunk-cli-v2.1.0-darwin-arm64.zip |
macOS (Apple Silicon only) |
splunk-cli-v2.1.0-linux-amd64.zip |
Linux x86_64 |
splunk-cli-v2.1.0-linux-arm64.zip |
Linux ARM64 |
splunk-cli-v2.1.0-windows-amd64.zip |
Windows x86_64 |