Navigating the Splunk Interface
The frame around the search
Nearly all user work happens in the Search & Reporting app, the default app. The top app bar holds the app menu, Settings, and the Activity menu (Jobs, Searches & Reports, Triggers), plus account, Help, and Messages. The search bar pairs search text with the time range picker, which defaults to a relative window ending now.
Search modes
- Smart (default): does field discovery while the search runs, then trims to fields you use.
- Fast: field discovery off; only fields the search itself needs are extracted - quicker, fewer sidebar fields.
- Verbose: full field discovery plus extra job details; slowest.
Results area
The tabs above results are Events, Patterns, Statistics, and Visualization. Raw events display by default, but as soon as a transforming command (stats, chart, top, timechart…) appears, the Statistics tab becomes the default view.
The fields sidebar lists Selected Fields (named in the search) and Interesting Fields - fields present in at least 20% of returned events, with roughly the top 20 displayed. Clicking a value adds it to the search.
Settings
Settings is the home for Data inputs, Fields (extractions, calculated fields, aliases), Lookups, Users and roles, Licensing, and Distributed environment.
Traps
Know the default search mode; know the 20% threshold for interesting fields; know the job inspector lives under Activity > Jobs; and remember Settings holds global/app configuration, while many knowledge objects can also be created inline from an event's actions menu.
Rule of thumb: if the Statistics tab opened first, the search contains a transforming command.