Splunk Cheat Sheet

Reference for Splunk Search Processing Language (SPL), common commands, and index/source configuration for log analytics.

2 PagesIntermediateFeb 2, 2026

SPL Basics

Common search pipeline patterns.

sql

index=web_logs status=500| stats count by host| sort -countindex=app_logs "error"| timechart span=1h countindex=web_logs| eval response_time_ms=response_time*1000| stats avg(response_time_ms) as avg_ms by endpoint

Key SPL Commands

Frequently used commands in the search pipeline.

stats- Aggregates values (count, sum, avg, min, max) grouped by fields
eval- Computes or transforms a field using an expression
timechart- Creates a time-series table/chart bucketed by a span
rex- Extracts fields from raw text using a regular expression
table- Restricts output to a specified set of fields, in order
dedup- Removes duplicate events based on specified fields
lookup- Enriches events with data from a lookup table (e.g. CSV)

props.conf Source Config

Defines how Splunk parses a specific source type at index time.

ini

[my_app_log]TIME_FORMAT = %Y-%m-%d %H:%M:%SLINE_BREAKER = ([\r\n]+)SHOULD_LINEMERGE = falseTIMESTAMP_FIELDS = timestampCHARSET = UTF-8

Splunk CLI

Common splunk CLI operations.

bash

splunk start                                # Start Splunksplunk add index my_index                  # Create a new indexsplunk add oneshot /var/log/app.log -index my_indexsplunk search 'index=my_index | head 10'    # Run a search from CLIsplunk btool props list --debug             # Debug parsing config

Pro Tip

Push field extraction and filtering as early in the pipeline as possible (before stats/timechart) — SPL evaluates left to right, and reducing the event set early dramatically improves search performance on large indexes.

Was this cheat sheet helpful?

Nagios Cheat Sheet

PagerDuty Cheat Sheet