opschain admin siem show

Included from Basic tier

Shows one SIEM forwarder connection by code or id, with its delivery health: the receiver token is reported as presence only, never the value. An otlp_http connection adds its Protocol, Auth header, TLS verify and CA certificate lines (the trust anchor as system roots, inline PEM or the file path — never the PEM body), and its token line reads Token.

opschain admin siem show splunk-main
Code:             splunk-main
Id:               0193...
Display name:     SOC Splunk
Kind:             splunk_hec
Target:           https://splunk.example.com:8088/services/collector/event
Event filter:     warn:,error:
HEC token:        set (write-only)
Enabled:          yes
Last delivered:   2026-11-02T10:30:00Z
Lag:              2s
Failures:         -

Lag is how far the delivery cursor trails the newest event; Failures the consecutive failed attempts (a sustained streak also lands a throttled warn:siem:delivery_failing event carrying the last error). Last error prints beneath the health lines while the connection is failing.

Flags

Flag	Meaning
--server <url>	Server base URL (default: the active context / OPSCHAIN_SERVER).
--auth-token <token>	Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login).

See also

• opschain docs cli/admin-siem-test — probe the receiver with a synthetic event.