I85PREP
⌘ K
Splunk Core Certified User study materials
Splunk Core Certified User study resources

Splunk Core Certified User: Basic Searching

Splunk Core Certified User · Work through your exam, one topic at a time.

All guide sections

Basic Searching

Syntax you must be able to read

A bare term is a keyword search across all fields: error finds any event containing it. Combine with AND (implicit), OR, and NOT, and group with parentheses. Quote phrases: "connection reset". The only wildcard is *; trailing wildcards (fail*) are efficient, leading ones (*fail) are slow.

Field-value syntax ties a search to an extracted field: status=404, status!=404, bytes>1000. Beware that != also returns events where the field does not exist at all.

Searches are case-insensitive by default; regex inside commands such as rex is case-sensitive unless you add (?i).

Time

earliest=-24h latest=now inside the search line overrides the time range picker. Snap with @: -7d@d starts at midnight seven days ago; @h snaps to the top of the hour.

Pipes

The | passes results to the next command: index=web status=404 | stats count by host counts hits per host. Subsearches in square brackets run first and feed their results to the outer search.

Traps

  • A search cannot begin with NOT - write * NOT error.
  • The implicit AND between terms means a b is a AND b, which breaks careless OR groupings.
  • Keyword matching on a value hits any field; field=value restricts the match.
  • A field named in stats by that does not exist produces a null group.

Rule of thumb: scope with index and time first, filter with field=value, then transform with a piped command.