Splunk Power User flashcards
Splunk Power User · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Hot bucket
- A hot bucket is the newest, writable bucket in an index; indexers write incoming events to it until maxDataSize is reached, then it rolls to warm.
- Bloom filter
- A per-bucket file that lets an indexer quickly determine whether a search term might exist in that bucket, skipping buckets that definitely do not contain it.
- Search job lifetime
- A search job with no activity is cancelled after 10 minutes by default; the TTL is configurable and can be extended while the job is still displayed.
- Subsearch limits
- A subsearch enclosed in square brackets returns at most 10,000 results and runs at most 60 seconds by default before it is truncated or terminated.
- Search modes
- Smart extracts only fields needed by the search, Fast disables field discovery for non-required fields, and Verbose extracts all fields and returns all matching events.
- Streaming versus transforming
- Streaming commands such as eval and rex process events as they arrive on indexers, while transforming commands such as stats run on the search head and collapse events into results.
- _indextime
- The timestamp recording when an event was indexed, distinct from _time, the event's own timestamp; it helps locate older events that were indexed recently.
- Default fields
- host, source, sourcetype, index, linecount, _time, _raw, and splunk_server are present on every event, plus search-time fields eventtype and tag.
- Named capture group
- In Splunk regex, (?<fieldname>pattern) creates a field named fieldname holding the text matched by pattern; used with rex and field transform stanzas.
- rex command
- rex field=_raw "user=(?<user>\w+)" extracts fields at search time using named groups; max_match=0 returns all matches instead of only the first.
- Calculated field
- A search-time field defined by an eval expression in props.conf as EVAL-fieldname; it is computed when used and is never stored in the index.
- Field alias
- A search-time mapping giving an existing field an additional name, so searches can use either name without altering raw data or index-time fields.
- Multivalue field
- A single field holding multiple values for one event; use mvcount, mvexpand, mvjoin, or values() in stats to count, expand, join, or collect them.
- Non-capturing group
- (?:pattern) groups alternation or quantifiers without creating a captured field; unnamed parentheses in Splunk regex do not create fields unless named.
- Transforming command
- stats, chart, timechart, top, and rare convert events into a results table; commands needing raw events, such as rex or transaction, cannot follow them.
- stats count by
- stats count by host groups events by each distinct host value and returns one row per group containing the number of matching events.
- timechart span
- timechart divides _time into bins of the given span, such as span=1h, and returns one row per bin with one column per split-by series.
- eventstats command
- eventstats computes aggregates across all events and appends the result to every event, unlike stats, which discards the original events and returns only aggregate rows.
- Dashboard token
- A token is a variable such as $host_token$ set by a dashboard input and referenced in panel searches, letting inputs drive and link searches.
- Report acceleration
- A saved report whose results are precomputed into summary tsidx files, so later runs read the summaries instead of rescanning raw events.
- Tag
- A tag is a name applied to a specific field-value pair; searching tag=security returns events whose tagged field values include the security tag.
- Event type
- A saved search that labels matching events with a value of the eventtype field; searchable as eventtype=name and applied at search time.
- CSV lookup
- A lookup table stored as a comma-separated file, paired with a lookup definition, used by the lookup command or automatic lookups to add fields to events.
- Automatic lookup
- A props.conf setting named LOOKUP-name that runs a lookup against every event of a sourcetype at search time, adding the table's fields.
- inputlookup command
- inputlookup reads the contents of a lookup table file into the search pipeline as results, without searching any index or raw events.
- Workflow action
- A knowledge object that creates a link from a field value in an event to an external resource, either a GET URL or a POST form submission.
- Root event dataset
- The base dataset of a data model; its constraints filter events and its attributes become fields that Pivot and tstats can use.
- Data model acceleration
- Precomputes a data model into tsidx summary files so Pivot and tstats query summaries instead of raw events, greatly reducing search time.
- tstats command
- tstats queries accelerated data model summaries with syntax like | tstats count from datamodel=DM.Object by Object.field, avoiding raw event scanning.
- Pivot
- A Splunk interface that builds reports from a data model by applying filters, splitting rows and columns, and choosing an aggregation without writing SPL.
- Child dataset
- An object nested under a parent in a data model; it inherits the parent's constraints and adds its own, narrowing the set of events it represents.
- summariesonly option
- Setting summariesonly=true on tstats restricts results to time ranges that have already been accelerated, so unaccelerated periods return no data.