Splunk Core Certified User key terms

The Splunk component that receives and stores incoming data in indexes and processes search requests against that stored data. It builds and maintains the index buckets that make searches fast.

The Splunk component that provides the search interface and distributes searches to indexers, then merges the results. It runs the user interface, knowledge objects, and search-time processing.

A lightweight Splunk agent installed on a data source host. It collects local files and other inputs and sends the data to an indexer or another forwarder, with minimal processing.

A Splunk Enterprise instance that pushes configuration apps and settings to groups of forwarders or other instances, keeping their configurations consistent without manual edits on each machine.

A repository of Splunk data organized into buckets and identified by a name. Searches reference the index name to limit which stored events are retrieved.

A directory of indexed data on an indexer. Buckets move through hot, warm, cold, and frozen states as data ages, and each holds raw data plus index files.

The top navigation bar in Splunk Web showing the current app, Messages, Settings, and the user account. It gives quick access to global actions from any page.

The horizontal menu below the Splunk bar that lists the views and pages belonging to the currently selected app, such as Search, Reports, Alerts, and Dashboards.

The default Splunk app used for searching, saving reports, creating alerts, and building dashboards. Most day-to-day work in Splunk starts here.

The text field at the top of the Search & Reporting app where a user types search strings and SPL commands, chooses a time range, and runs the search.

The control beside the search bar that sets the earliest and latest times of a search. Presets like Last 24 hours or custom dates define the window of events returned.

The left panel of the search results page listing selected and interesting fields for the current results, with value counts you can click to add to the search.

The query language used in Splunk searches. It combines search terms with commands connected by pipes to filter, transform, and display results.

A running or completed instance of a search that Splunk executes and tracks. Jobs have IDs, can be inspected, paused, or shared, and results can be exported.

A single piece of machine data in Splunk, made of a timestamp and a raw text segment. Events are the individual records that searches return and count.

An argument added to a search command, such as earliest=-24h, that overrides the time range picker for part of a search. It limits which events the command processes.

The vertical bar character that passes the output of one search command as input to the next. It lets you chain commands to refine and transform results step by step.

A search enclosed in square brackets that runs first and feeds its results into the surrounding search, often to filter by a list of values.

AND, OR, and NOT keywords used in search strings to combine terms. They control whether events must contain, may contain, or must not contain specified terms.

A searchable name-value pair extracted from event data, such as host=server1 or status=200. Fields let you filter, group, and analyze events without parsing raw text.

The process of turning parts of raw event text into named fields, either automatically at search time, through configuration files, or with a regular expression in the search.

Fields that Splunk detects in the results and shows in the left sidebar because they appear in a meaningful share of events. Clicking one adds it to the search.

A knowledge object that categorizes events matching a saved search string, letting users refer to a group of similar events by a short name in later searches.

A knowledge object that attaches a descriptive label to field-value combinations, so searches can refer to the tag name instead of the underlying field and value.

A file, such as a CSV, that maps field values in your events to additional information. Splunk joins it to events at search time to enrich results.

The knowledge object that tells Splunk how to connect a lookup table file to your data, specifying the file, the lookup fields, and which fields to match.

A knowledge object that computes a new field from an expression on existing fields at search time, so the value is available without changing raw data.

A reusable block of SPL stored as a knowledge object. Calling the macro name in a search inserts its saved search string, promoting consistency across many searches.

Any user-created configuration in Splunk that adds meaning to data, such as fields, lookups, event types, tags, macros, saved searches, and reports. They are shared through apps.

A search string plus its time range and other settings that is stored in Splunk so it can be rerun, scheduled, or shared rather than retyped each time.

A saved search with a schedule and trigger condition that notifies people or runs an action when results match, such as sending email or calling a webhook.

A saved search whose results are formatted for viewing or sharing, often with a table or chart. Reports can be added to dashboards and run on demand or on a schedule.

A collection of panels that display searches and visualizations on one page. Dashboards give an at-a-glance view of data and can be shared with other users.

A single container on a dashboard that holds one search and its visualization, such as a chart, table, or single value. Panels are arranged and resized by the dashboard editor.

A five-field expression, such as */5 * * * *, that defines when a scheduled search or alert runs. Each field sets minute, hour, day of month, month, and day of week.

The rule that decides when an alert should fire, for example when the number of results is greater than zero or exceeds a threshold. It is checked after the search runs.

A transforming SPL command that calculates aggregates such as count, sum, average, and distinct values, grouped by chosen fields. It replaces individual events with summary rows.

A transforming SPL command that produces a time-series chart by aggregating events into time buckets and splitting them by a field. It is often used to show trends.