Splunk Tutorials: Splunk Commands Reference - DevOpsSchool.com (2024)

Here’s an updated table with example queries that utilize the respective Splunk commands:

CommandDescriptionSee also
abstractProduces a summary of each search result.highlight
accumKeeps a running total of the specified numeric field.autoregress, delta, trendline, streamstats
addcoltotalsComputes an event that contains sum of all numeric fields for previous events.addtotals,stats
addinfoAdd fields that contain common information about the current search.search
addtotalsComputes the sum of all numeric fields for each result.addcoltotals,stats
analyzefieldsAnalyze numerical fields for their ability to predict another discrete field.anomalousvalue
anomaliesComputes an “unexpectedness” score for an event.anomalousvalue, cluster, kmeans, outlier
anomalousvalueFinds and summarizes irregular, or uncommon, search results.analyzefields, anomalies, cluster, kmeans, outlier
appendAppends subsearch results to current results.appendcols, appendcsv, join, set
appendcolsAppends the fields of the subsearch results to current results, first results to first result, second to second, etc.append, appendcsv, join, set
appendpipeAppends the result of the subpipeline applied to the current result set to results.append,appendcols,join,set
arulesFinds association rules between field values.associate,correlate
associateIdentifies correlations between fields.correlate, contingency
auditReturns audit trail information that is stored in the local audit index.
autoregressSets up data for calculating the moving average.accum, autoregress, delta, trendline, streamstats
bin, discretizePuts continuous numerical values into discrete sets.chart, timechart
bucketdirReplaces a field value with higher-level grouping, such as replacing filenames with directories.cluster, dedup
chartReturns results in a tabular output for charting. SeeFunctions for stats, chart, and timechartin the Splunk EnterpriseSearch Reference.timechart
clusterClusters similar events together.anomalies, anomalousvalue, cluster, kmeans, outlier
concurrencyUses a duration field to find the number of “concurrent” events for each event.timechart
contingency, counttable, ctableBuilds a contingency table for two fields.associate, correlate
convertConverts field values into numerical values.eval
correlateCalculates the correlation between different fields.associate, contingency
dbinspectReturns information about the specified index.
dedupRemoves subsequent results that match a specified criteria.uniq
deltaComputes the difference in field value between nearby results.accum, autoregress, trendline, streamstats
diffReturns the difference between two search results.
erexAllows you to specify example or counter example values to automatically extract fields that have similar values.extract,kvform,multikv,regex,rex,xmlkv
evalCalculates an expression and puts the value into a field. SeeFunctions for eval and wherein the Splunk EnterpriseSearch Reference.where
eventcountReturns the number of events in an index.dbinspect
eventstatsAdds summary statistics to all search results.stats
extract, kvExtracts field-value pairs from search results.kvform, multikv, xmlkv, rex
fieldformatExpresses how to render a field at output time without changing the underlying value.eval, where
fieldsRemoves fields from search results.
fieldsummaryGenerates summary information for all or a subset of the fields.af, anomalies, anomalousvalue, stats
filldownReplaces NULL values with the last non-NULL value.fillnull
fillnullReplaces null values with a specified value.
findtypesGenerates a list of suggested event types.typer
foreachRun a templatized streaming subsearch for each field in a wildcarded field list.eval
formatTakes the results of a subsearch and formats them into a single result.
fromRetrieves data from a dataset, such as a data model dataset, a CSV lookup, a KV Store lookup, a saved search, or a table dataset.
gaugeTransforms results into a format suitable for display by the Gauge chart types.
gentimesGenerates time-range results.
geostatsGenerate statistics which are clustered into geographical bins to be rendered on a world map.stats,xyseries
headReturns the first number n of specified results.reverse, tail
highlightCauses Splunk Web to highlight specified terms.
historyReturns a history of searches formatted as an events list or as a table.search
inputAdds sources to Splunk or disables sources from being processed by Splunk.
inputcsvLoads search results from the specified CSV file.loadjob, outputcsv
iplocationExtracts location information from IP addresses.
joinSQL-like joining of results from the main results pipeline with the results from the subpipeline.selfjoin, appendcols
kmeansPerforms k-means clustering on selected fields.anomalies, anomalousvalue, cluster, outlier
kvformExtracts values from search results, using a form template.extract, kvform, multikv, xmlkv, rex
loadjobLoads events or results of a previously completed search job.inputcsv
localizeReturns a list of the time ranges in which the search results were found.map, transaction
makecontinuousMakes a field that is supposed to be the x-axis continuous (invoked by chart/timechart)chart, timechart
makemvChange a specified field into a multivalued field during a search.mvcombine, mvexpand, nomv
mapA looping operator, performs a search over each search result.
mcollectConverts search results into metric data and inserts the data into a metric index on the search head.collect,meventcollect
metadataReturns a list of source, sourcetypes, or hosts from a specified index or distributed search peer.dbinspect
metasearchRetrieves event metadata from indexes based on terms in the logical expression.metadata,search
meventcollectConverts search results into metric data and inserts the data into a metric index on the indexers.collect,mcollect
mstatsCalculates statistics for the measurement, metric_name, and dimension fields in metric indexes.stats
multikvExtracts field-values from table-formatted events.
multisearchRun multiplestreaming searchesat the same time.append, join
mvcombineCombines events in search results that have a single differing field value into one result with a multivalue field of the differing field.mvexpand, makemv, nomv
mvexpandExpands the values of a multivalue field into separate events for each value of the multivalue field.mvcombine, makemv, nomv
nomvChanges a specified multivalued field into a single-value field at search time.makemv, mvcombine, mvexpand
outlierRemoves outlying numerical values.anomalies, anomalousvalue, cluster, kmeans
outputcsvOutputs search results to a specified CSV file.inputcsv, outputtext
outputtextOuputs the raw text field (_raw) of results into the_xmlfield.outputtext
predictEnables you to use time series algorithms to predict future values of fields.x11
rangemapSets RANGE field to the name of the ranges that match.
rareDisplays the least common values of a field.stats, top
regexRemoves results that do not match the specified regular expression.rex,search
reltimeConverts the difference between ‘now’ and ‘_time’ to a human-readable value and adds adds this value to the field, ‘reltime’, in your search results.convert
renameRenames a specified field; wildcards can be used to specify multiple fields.
replaceReplaces values of specified fields with a specified new value.
restAccess a REST endpoint and display the returned entities as search results.
returnSpecify the values to return from a subsearch.format, search
reverseReverses the order of the results.head, sort, tail
rexSpecify a Perl regular expression named groups to extract fields while you search.extract, kvform, multikv, xmlkv, regex
rtorderBuffers events from real-time search to emit them in ascending time order when possible.
savedsearchReturns the search results of a saved search.
script, runRuns an external Perl or Python script as part of your search.
scrubAnonymizes the search results.
searchSearches Splunk indexes for matching events.
searchtxnFinds transaction events within specified search constraints.transaction
selfjoinJoins results with itself.join
sendemailEmails search results to a specified email address.
setPerforms set operations (union, diff, intersect) on subsearches.append, appendcols, join, diff
setfieldsSets the field values for all results to a common value.eval,fillnull,rename
sortSorts search results by the specified fields.reverse
spathProvides a straightforward means for extracting fields from structured data formats, XML and JSON.xpath
statsProvides statistics, grouped optionally by fields. SeeFunctions for stats, chart, and timechartin the Splunk EnterpriseSearch Reference.eventstats, top, rare
strcatConcatenates string values.
streamstatsAdds summary statistics to all search results in a streaming manner.eventstats, stats
tableCreates a table using the specified fields.fields
tagsAnnotates specified fields in your search results with tags.eval
tailReturns the last number n of specified results.head, reverse
timechartCreate a time series chart and corresponding table of statistics. SeeFunctions for stats, chart, and timechartin the Splunk EnterpriseSearch Reference.chart, bucket
topDisplays the most common values of a field.rare, stats
transactionGroups search results into transactions.
transposeReformats rows of search results as columns.
trendlineComputes moving averages of fields.timechart
typeaheadReturns typeahead information on a specified prefix.
typerCalculates the eventtypes for the search results.typelearner
uniqRemoves any search that is an exact duplicate with a previous result.dedup
untableConverts results from a tabular format to a format similar tostatsoutput. Inverse ofxyseriesandmaketable.
wherePerforms arbitrary filtering on your data. SeeFunctions for eval and wherein the Splunk EnterpriseSearch Reference.eval
x11Enables you to determine the trend in your data by removing the seasonal pattern.predict
xmlkvExtracts XML key-value pairs.extract, kvform, multikv, rex
xmlunescapeUnescapes XML.
xpathRedefines the XML path.
xyseriesConverts results into a format suitable for graphing.

The search commands that make up the Splunk Light search processing language are a subset of the Splunk Enterprise search commands. The tables below list the commands that make up the Splunk Light search processing language and is categorized by their usage. Some commands fit into more than one category based on the options that you specify.

These commands can be used to build correlation searches.

These commands can be used to learn more about your data and manager your data sources.

These commands return information about the data you have in your indexes. They do not modify your data or indexes in any way.

These are some commands you can use to add data sources to or delete specific data from your indexes.

These are commands you can use to add, extract, and modify fields or field values. The most useful command for manipulating fields isevaland itsfunctions.

Use these commands to add new fields.

Use these commands to modify fields or their values.

These commands are used to find anomalies in your data. Either search for uncommon or outlying events and fields or cluster similar events together.

These commands add geographical information to your search results.

These commands work with metrics data.

These commands predict future values and calculate trendlines that can be used to create visualizations.

These commands are used to buildtransforming searches. These commands return statistical data tables required for charts and other kinds of data visualizations.

These commands can be used to manage search results. For example, you can append one set of results with another, filter more events from the results, reformat the results, and so on.

Use this command to email the results of a search.

Use these commands to append one set of results with another set or to itself.

Use these commands to remove more events or fields from your current results.

Use these commands to reformat your current results.

Use these commands to generate or return events.

Use these commands to group or classify the current results.

Use these commands to change the order of the current search results.

Use these commands to read in results from external files or previous searches.

Use these commands to define how to output current search results.

Use these commands to search based on time ranges or add time information to your events.

The following commands are supported in SPL2. Use the links in the table to see the command syntax, examples, and usage information.

Splunk Tutorials: Splunk Commands Reference - DevOpsSchool.com (2024)


Top Articles
Latest Posts
Article information

Author: Ms. Lucile Johns

Last Updated:

Views: 6179

Rating: 4 / 5 (61 voted)

Reviews: 92% of readers found this page helpful

Author information

Name: Ms. Lucile Johns

Birthday: 1999-11-16

Address: Suite 237 56046 Walsh Coves, West Enid, VT 46557

Phone: +59115435987187

Job: Education Supervisor

Hobby: Genealogy, Stone skipping, Skydiving, Nordic skating, Couponing, Coloring, Gardening

Introduction: My name is Ms. Lucile Johns, I am a successful, friendly, friendly, homely, adventurous, handsome, delightful person who loves writing and wants to share my knowledge and understanding with you.