opschain admin siem list

Included from Basic tier

Lists every SIEM forwarder connection, code ascending: kind, receiver target, event filter, enabled state, delivery lag and failure streak.

opschain admin siem list
CODE         KIND        TARGET                                                FILTER       ENABLED  LAG  FAILURES
splunk-main  splunk_hec  https://splunk.example.com:8088/services/collector/…  warn:,error: yes      2s   -
soc-syslog   syslog      tls://siem.example.com:6514                           all events   yes      1s   -
tempo        otlp_http   https://tempo.example.com:4318                        all events   yes      3s   -

-o, --output json|yaml emits the connection rows as a machine document — each carries secret_set (whether a receiver token is stored), never the token value, the otlp_http receiver facts (protocol, auth_header, ssl_verify, ssl_ca_cert), plus the full health object (last_delivered_at, consecutive_failures, last_error, lag_seconds, cursor_created_at).

Flags

Flag	Meaning
--server <url>	Server base URL (default: the active context / OPSCHAIN_SERVER).
--auth-token <token>	Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login).
--filter <column>[!]=<value>	Keep only rows matching the term (repeatable; terms AND). Columns are the printed table headers lowercased; * wildcards match the whole cell case-insensitively, != negates, commas mean any-of. Applied client-side. Grammar: opschain docs cli.

See also

• opschain docs cli/admin-siem-show — one connection in full.