config.example.toml

# splunk-cli example configuration
# Copy this file to ~/.config/splunk-cli/config.toml and fill in your values.
# All settings can also be overridden via environment variables (SPLUNK_HOST, etc.)
# or CLI flags.

[splunk]
# Splunk server URL including port (required)
host = "https://your-splunk.example.com:8089"

# Authentication: use either token (recommended) or user + password.
token = ""
# user     = ""
# password = ""

# App context for searches (optional, default: no app namespace)
# app = "search"

# Knowledge object owner (default: nobody)
# owner = "nobody"

# Skip TLS certificate verification — use only for self-signed certs in dev
# insecure = false

# Per-request HTTP timeout (default: 30s)
# http_timeout = "30s"

# Maximum results to return per run/results command (0 = all)
# limit = 0

# How splunk-cli wraps the SPL you submit:
#   "pipe-only" (default) — prepend "search " unless the SPL starts with "|".
#                           Matches the historical behavior; if you write
#                           `search index=foo`, the submitted SPL becomes
#                           `search search index=foo` (Splunk treats the
#                           second `search` as a literal token to match).
#   "auto"                — also skip the prefix when the SPL already starts
#                           with the `search` command (followed by a space
#                           or end of string). Convenient if you paste from
#                           Splunk Web; does not protect against macros that
#                           expand to a leading command.
#   "off"                 — never prepend. You must supply a complete SPL,
#                           including any leading `search` or generating
#                           command.
# Override per-invocation with `--prepend auto|pipe-only|off`.
# prepend = "pipe-only"