Splunk Core Certified User: Alerts, Statistical Reports, and Dashboards

Statistical commands

Transforming commands turn events into a results table. stats is the workhorse: stats count by host, stats avg(response) as avg_resp by app, dc(user) for distinct count, values()/list() to collect. stats discards raw events - output contains only the by fields and the aggregates. top shows the ten most common values with count and percent by default; rare shows the least common. chart pivots a field across the x-axis; timechart span=1h pivots over time. eventstats adds aggregates to each original event while keeping raw data; streamstats does it running/cumulative.

Alerts

An alert is a saved search plus: a schedule (cron or interval), a trigger condition (number of results, or a custom eval such as where count > 10), and an action (email, webhook, RSS, script). Throttling suppresses repeat notifications for a window, optionally per field. Without a schedule there is nothing to trigger.

Reports and dashboards

Saving a search as a report lets you schedule it (for example, email a PDF) or add it as a dashboard panel. Panels include charts, tables, single values, and event listings. Classic dashboards and Dashboard Studio both support time-range pickers and tokens ($field$) that pass values between inputs and searches.

Traps

• Using stats when raw events are still needed - use eventstats.
• Forgetting that chart/timechart need a split field.
• Confusing top (count plus percent) with plain stats count.
• Expecting an alert to fire with no trigger condition or schedule.

Rule of thumb: index=sales | stats sum(amount) as total by product | sort -total.