opschain admin siem update
Included from Basic tier
Partially updates a SIEM forwarder connection by code or id. Only the flags
you pass change; the code and kind are immutable. A supplied receiver
token (--secret-env / --secret-prompt) rotates the stored one —
write-only, never echoed. --event-filter replaces the stored filter:
pass an empty value (--event-filter '') to forward every event again.
Fields belonging to another kind refuse by name.
NEW_TOKEN=... opschain admin siem update splunk-main --secret-env NEW_TOKEN
Updated SIEM connection splunk-main
opschain admin siem update splunk-main --event-filter 'warn:,error:,audit:,api:security:'
opschain admin siem update soc-syslog --enabled=false
opschain admin siem update tempo --protocol json --ssl-ca-cert /etc/opschain/tempo-ca.pem
Flags
| Flag | Meaning |
|---|---|
--display-name <name> | Human-readable connection name. |
--endpoint-url <url> | splunk_hec: the HEC collector URL. otlp_http: the receiver's base URL. |
--secret-env <name> | Name of an environment variable holding the replacement receiver token — Splunk HEC or OTLP (never pass the value itself on the command line). |
--secret-prompt | Prompt for the replacement token without echo (reads a line from stdin when piped). |
--syslog-address <host:port> | syslog: the receiver's address. |
--syslog-transport <t> | syslog: udp, tcp or tls. |
--protocol <p> | otlp_http: protobuf or json. |
--auth-header <name> | otlp_http: the header the token travels in; pass an empty value (--auth-header '') to restore Authorization: Bearer. |
--ssl-verify | otlp_http: verify the receiver's TLS certificate (--ssl-verify=false opts out). |
--ssl-ca-cert <pem-or-path> | otlp_http: the CA trust anchor; an empty value restores the system roots. |
--event-filter <prefixes> | Replace the forwarded event-type prefixes, comma-separated; empty forwards every event. |
--enabled | Whether the connection forwards events. Disabling pauses the cursor in place; re-enabling resumes from the paused position. |
--server <url> | Server base URL (default: the active context / OPSCHAIN_SERVER). |
--auth-token <token> | Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login). |
See also
opschain docs cli/admin-siem-show— the connection's current fields and health.