Splunk Core Certified User cheat sheet

Splunk roles: forwarders (Universal or Heavy) collect data, indexers parse and store it, search heads run searches and serve Splunk Web.

A Universal Forwarder is a lightweight binary with no web interface and no Python; it only collects and forwards data and is configured via .conf files or CLI.

A Heavy Forwarder is a full Splunk Enterprise instance that can parse, filter, route data, and run scripted inputs before forwarding to indexers.

Ports: 8000 = Splunk Web, 8089 = management/REST (splunkd), 9997 = receiving data from forwarders over the Splunk-to-Splunk protocol.

inputs.conf on a forwarder defines what is monitored; outputs.conf defines the target indexer(s) and receiving port.

Buckets age hot to warm to cold to frozen; frozen buckets are deleted by default unless archiving is configured.

An index is a named repository of bucket data plus its knowledge objects; the default index is named main.

The license master tracks license usage, the deployment server distributes apps and configuration to forwarders, and the cluster master manages indexer replication.

Splunk Web is reached at http://:8000; after login the Search & Reporting app opens by default.

The time range picker sets the window of events that the search runs over; the default is Last 24 hours and changing it re-runs the search.

Search modes: Smart (default), Fast (field discovery off, faster), Verbose (all field data returned).

Search page tabs: Events (raw results), Patterns, Statistics, and Visualization.

The timeline below the search bar graphs event counts over time; clicking a bar or dragging a region changes the search time range.

Settings includes Users and Roles, Data Inputs, Indexes, Fields (extractions and calculated fields), Lookups, and Server settings.

The Apps menu switches between installed apps, each bundling its own dashboards, saved searches, and configurations.

Settings > Activity lists running and completed search jobs and links to the Job Inspector for performance details.

Space-separated terms are implicitly ANDed; use uppercase OR for alternatives and NOT or ! to exclude.

Operator precedence is NOT, then OR, then AND; parentheses override the default order.

field=value matches exactly; field=* requires the field to exist; quote any value or phrase containing spaces.

The asterisk is a wildcard that matches any string and is efficient mainly as a trailing wildcard; leading wildcards are slow and generally avoided.

A search must start with a search-generating command (such as search or a data-retrieval command) before the first pipe.

The pipe | passes the current result set to the next command, so each downstream command sees only upstream results.

Time can be constrained with earliest and latest either in the time picker or directly in the search string, e.g. earliest=-1h.

Transforming commands include stats, chart, timechart, top, rare; filtering and ordering commands include table, fields, dedup, sort, head, tail, rename.

Default fields in every event: host, source, sourcetype, index, _time, and _raw.

Indexed fields are extracted at index time through props.conf/transforms.conf; extracted (custom) fields are created at search time.

Field extraction methods include inline/rex, delimiter-based, regular expression transforms, JSON, XML, and CSV.

A field alias gives an existing field a second name; a calculated field creates a new field using an eval expression at search time.

A lookup enriches events by matching a key field against a CSV file or KV store collection; lookup adds fields, inputlookup reads the table itself.

An automatic lookup is configured for a sourcetype or host so enrichment runs without adding a lookup command to the search.

Knowledge objects include field extractions, field aliases, calculated fields, lookups, tags, event types, macros, and workflow actions.

Macros are reusable saved search fragments invoked inside backticks and can accept arguments.

The Fields sidebar shows Selected Fields, Interesting Fields (frequently occurring fields), and All Fields.

stats returns one row per group, e.g. | stats count, avg(bytes) BY host; count with no BY clause yields a single overall row.

Common stats functions: count, dc (distinct count), sum, avg, min, max, values, and list.

timechart plots a statistical value over _time; set bucket size with span (e.g. span=1h) and split series with a BY field.

top and rare return the most and least common values of a field along with count and percent.

Alert types are scheduled (cron), real-time rolling window, and real-time per-result; scheduled searches run without a user logged in.

Alert trigger conditions include number of results, number of hosts, and custom eval conditions; actions include email, webhook, script, log event, and output to an index.

Throttling suppresses alert actions for a set period and can be scoped by field values to prevent duplicate notifications.

Save As > Report stores a search with its formatting; Save As > Dashboard panel adds the result to a dashboard.

Dashboard panels render a saved search as a chart, table, single value, or map and refresh from the underlying search.