Splunk Power User cheat sheet

The search head parses SPL, dispatches the job, and merges results; indexers search their local buckets. Streaming commands (search, eval, where, rex) are distributed to indexers, while transforming commands (stats, chart, timechart) run on the search head.

Bucket lifecycle: hot (writable) -> warm -> cold -> frozen (deleted) -> thawed (restored from archive). A hot bucket rolls to warm when maxDataSize is reached; the auto setting is roughly 750MB on small systems and 10GB otherwise.

Every bucket carries a time range, so the indexer skips any bucket whose range does not overlap the search's earliest/latest values before reading events.

The lexicon maps terms to the buckets containing them, .tsidx files hold term-to-event postings, and bloom filters let the indexer rule out buckets that definitely lack a term.

Job states progress queued -> parsing -> running -> finalizing -> done; a job with no activity is cancelled after 10 minutes by default (TTL is configurable and can be extended).

A subsearch in square brackets runs before the outer search and is capped by default at 10,000 results (maxout) and 60 seconds (maxtime); exceeding either truncates or terminates it.

Search modes: Smart performs field discovery only for fields the search needs, Fast disables field discovery for non-required fields, Verbose extracts every field and returns all matching events.

The UI returns a maximum of 10,000 events and exports return up to 50,000 by default; use fields, table, or head to keep result sets small.

The time range picker applies an implicit filter on _time; _indextime records when the event was indexed and differs from the event's own _time value.

Always-present fields: host, source, sourcetype, index, _time, _raw, linecount, splunk_server, plus search-time eventtype and tag.

Named capture groups (?pattern) create a field; (?:pattern) is non-capturing; unnamed parentheses group but do not produce a Splunk field.

Regex tokens: \d digit, \w [A-Za-z0-9_], \s whitespace, . any character except newline, * zero or more, + one or more, ? zero or one, {n,m} range, [^abc] negated class; * is greedy, *? is lazy.

rex field=_raw "user=(?\w+)" extracts at search time; max_match=0 returns every match, and mode=sed performs a substitution instead of extraction.

extract with kvdelim/pairdelim parses delimited key-value pairs, spath parses JSON and XML, multikv parses tabular raw events into fields.

props.conf search-time settings: REPORT- names an extraction stanza, EVAL- defines a calculated field, LOOKUP- adds an automatic lookup, FIELDALIAS- renames a field.

Field aliases, calculated fields, and most extractions are search-time only: raw data and index-time fields are never modified.

Multivalue handling: values() and list() in stats, plus mvcount, mvexpand, mvjoin, makemv, and split; sort order depends on whether values are treated as numeric.

where evaluates an eval expression against extracted fields, whereas search matches keywords and wildcards; a leading wildcard in search prevents efficient term lookup.

Transforming commands -- stats, chart, timechart, top, rare, contingency -- collapse events into a results table; afterward only result-set commands (sort, head, where, eval, dedup) may follow, not rex or transaction.

stats count by host, sourcetype returns one row per distinct combination; common functions are count, dc, sum, avg, min, max, values, list, median, perc95, earliest, latest.

chart over by builds a matrix; timechart by bins _time using span=auto or an explicit span such as span=1h.

timechart and chart default to roughly 10 series unless limit is raised; useother and usenull control how remaining series and null values appear.

eventstats appends the aggregate to every event without removing events; streamstats computes running or cumulative values; neither is a transforming command.

Accelerated reports must be saved searches that use a transforming command; summaries are written as tsidx files and reused on later runs of the same report and time range.

Simple XML dashboards nest or -> -> -> <chart|table|single> -> , where holds the SPL and / set the panel time range.

Dashboard inputs (time range picker, dropdown, text box) set tokens such as $tok$ that panel searches reference; blocks with and chain inputs together.

A base search plus post-process searches lets several panels share one search; the base search must be a transforming or reporting search and is referenced by id.

Tags attach to a specific field-value pair, never to raw text alone; tag= returns events whose tagged field values carry that tag, and tags are applied at search time from tags.conf.

An event type is a saved search string stored in eventtypes.conf that assigns a value to the eventtype field; the field is multivalue when several event types match one event.

Lookup workflow: place the .csv lookup table file, create a lookup definition (transforms.conf), then call it with | lookup def field OUTPUT newfield or automatically via props.conf LOOKUP-.

lookup match types are exact (default), CIDR for IP ranges, and glob; a nonexistent key returns null unless the definition specifies a default match value.

inputlookup reads a lookup table file into the pipeline as results; outputlookup writes results back to the file, and append=t preserves existing rows.

KV store lookups keep rows in an app's KV store collection, support larger and updatable datasets, and are defined with collections.conf plus a transforms stanza.

Workflow actions attach a link to field values in events: GET actions build a URI with $field$ substitution, POST actions submit form fields; they are configured with label, fields, and link.uri.

Macros are reusable SPL fragments invoked as name(arg1,arg2) and defined in macros.conf; arguments are referenced as $arg1$, and iseval=1 makes the macro usable inside eval expressions.

Knowledge object permissions are private (owner), shared in an app, or global (all apps); scheduled searches and dashboards only see objects available in their app context.

A data model is a hierarchy of datasets: a root event, search, or transaction dataset, with child datasets that inherit and add constraints; attributes become usable fields.

Dataset types: event datasets constrain raw events, search datasets start from an arbitrary base search or table, and transaction datasets are built with the transaction command.

Constraints filter events on fields such as index, sourcetype, host, and _time; children inherit all parent constraints, narrowing the event set further down the tree.

Data model acceleration precomputes a dataset into tsidx summary files, so Pivot and tstats read summaries instead of raw events; only accelerated datasets support summariesonly=true.

tstats syntax: | tstats count from datamodel=DM.Object by Object.field, optionally with where, prestats=true plus a following stats, and fields or rename for shaping output.

Pivot elements are filters (constrain events), split rows, split columns, and column values (the aggregation); a saved Pivot can become a report or a dashboard panel without writing SPL.

Acceleration is bounded by the configured acceleration time range, so data outside that window is not summarized and returns no tstats results when summariesonly=true.

Acceleration jobs are scheduled and run by the search head that owns the data model, writing summaries that consume indexer disk space and are rebuilt as new data arrives.

tstats against accelerated summaries is typically far faster than the equivalent raw search because it reads only term and statistic postings, not raw events.