Splunk Power User key terms

The Splunk component that handles user interaction: it runs searches, manages knowledge objects, and distributes search work to indexers. Users connect to it through the web interface or CLI to run SPL searches.

The Splunk component that receives and stores incoming data in indexes and performs retrieval and processing of that data at search time. It builds and searches buckets of raw events.

A lightweight Splunk agent installed on a source machine that collects local data and sends it to an indexer or heavy forwarder. It does not parse or index data itself.

The query language used in Splunk to retrieve and manipulate events. A search is a series of commands joined by pipe characters, where each command passes its results to the next.

A search enclosed in square brackets that runs first inside another search. Its results feed into the outer search, typically supplying values for a filter or an IN clause.

A debugging and performance panel for a completed search. It shows execution costs, search duration, result counts, messages, and which phases of the job consumed the most time.

A setting controlling how much processing Splunk performs to produce results. Fast returns only the fields needed, Verbose returns all fields and event data, and Smart balances the two automatically.

The physical directory where an indexer stores a slice of index data, such as a range of events by time. Buckets move through hot, warm, cold, and frozen states as data ages.

A searchable name/value pair in an event, such as host=web01 or status=404. Fields let you filter, group, and calculate on data instead of reading raw text.

The process of teaching Splunk to pull a value out of raw event text and assign it a field name. Extraction can be automatic, regex-based, delimiter-based, or defined in a data model.

A pattern language for matching text. In Splunk it appears in commands such as rex, inside field extraction definitions, and in search filters to locate and capture specific substrings.

A regex subpattern written as (?...) that saves the matched text into a field with that name. Named groups let one pattern produce several usable fields at once.

A search command that extracts fields from raw event text using a regular expression at search time. It is often used for quick, one-off extractions or to test a pattern.

A command that helps you build a regular expression by supplying example values. Splunk generates a candidate pattern that matches your examples, which you can then refine.

A single field that holds more than one value for an event, such as several IP addresses. Values can be counted with mvcount, expanded with mvexpand, or filtered with mvfilter.

A command that creates or overwrites fields by calculating expressions, using functions for string, numeric, time, and conditional operations. It adds computed fields without removing existing ones.

A command that turns individual events into a summary result set, such as a table of counts by host. After a transforming command, the results are no longer raw events.

A transforming command that aggregates events into summary rows using functions such as count, sum, avg, and dc, grouped by one or more fields through the by clause.

A transforming command that produces a table of aggregated values over time, with time on the x-axis. It is the standard way to build trending charts in reports and dashboards.

A command that removes duplicate events based on the values of one or more fields, keeping the first or last occurrence. It is useful for finding unique combinations of values.

A saved search with a defined set of results, often displayed as a table or chart. Reports can be scheduled, shared, and added to dashboards as panels.

A collection of panels that display saved searches, reports, or charts side by side, usually with input controls. Dashboards give users a quick visual overview of data.

A placeholder variable in a dashboard whose value is set by an input or a drilldown and then substituted into panel searches. Tokens make dashboards interactive.

A shared search that runs once in a dashboard and is reused by several panels, which then apply their own post-processing. It reduces load by avoiding repeated identical searches.

A short keyword attached to field/value pairs so searches can refer to them by a friendly name, like tag=web. Tags group related values without changing the underlying data.

A saved definition that categorizes events by a search string, letting you label and group similar events. Event types can be used in searches and are often paired with tags.

A file or KV store collection holding reference data, such as a CSV of hostnames and owners. Splunk can join that data to events at search time using the lookup command.

A knowledge object that tells Splunk where a lookup table lives, which fields it contains, and how those fields should be matched to fields in your events.

A lookup configured to run automatically whenever events containing its match fields are searched, adding the lookup's fields without an explicit lookup command in the search.

A knowledge object that adds a clickable link to field values in search results, typically opening an external URL or running another search. It is defined per field.

A reusable block of SPL stored under a name and inserted into searches with backtick syntax, optionally with arguments. Macros keep complex search logic consistent and easier to maintain.

A knowledge object that makes one field name refer to another, so searches can use either name. Aliases help normalize data where different sources use different field names.

A structured, hierarchical description of data in terms of datasets, fields, and constraints. Data models make data easier to search and are the foundation for Pivot and acceleration.

A named node within a data model that defines a set of events or search results, such as a root event dataset or a child dataset narrowed by additional constraints.

A filter attached to a data model dataset that limits which events belong to it, usually by field values. Child datasets inherit and add to the constraints of their parent.

A point-and-click interface for building reports and charts from a data model without writing SPL. Users pick a dataset, split rows by fields, and add aggregated values.

A setting that precomputes a data model's statistics in the background so Pivot and tstats searches return results much faster, at the cost of disk space and processing.

A command that queries indexed fields and accelerated data models directly instead of raw events. It is much faster than a normal search when the needed fields are indexed or accelerated.

An index that stores the results of a scheduled report so later searches can read the precomputed results instead of rescanning raw events. It is a manual form of acceleration.