Splunk Cheat Sheet
Reference for Splunk Search Processing Language (SPL), common commands, and index/source configuration for log analytics.
SPL Basics
Common search pipeline patterns.
index=web_logs status=500| stats count by host| sort -countindex=app_logs "error"| timechart span=1h countindex=web_logs| eval response_time_ms=response_time*1000| stats avg(response_time_ms) as avg_ms by endpoint
Key SPL Commands
Frequently used commands in the search pipeline.
- stats- Aggregates values (count, sum, avg, min, max) grouped by fields
- eval- Computes or transforms a field using an expression
- timechart- Creates a time-series table/chart bucketed by a span
- rex- Extracts fields from raw text using a regular expression
- table- Restricts output to a specified set of fields, in order
- dedup- Removes duplicate events based on specified fields
- lookup- Enriches events with data from a lookup table (e.g. CSV)
props.conf Source Config
Defines how Splunk parses a specific source type at index time.
[my_app_log]TIME_FORMAT = %Y-%m-%d %H:%M:%SLINE_BREAKER = ([\r\n]+)SHOULD_LINEMERGE = falseTIMESTAMP_FIELDS = timestampCHARSET = UTF-8
Splunk CLI
Common splunk CLI operations.
splunk start # Start Splunksplunk add index my_index # Create a new indexsplunk add oneshot /var/log/app.log -index my_indexsplunk search 'index=my_index | head 10' # Run a search from CLIsplunk btool props list --debug # Debug parsing config
Advanced SPL: join, transaction, subsearch
Correlating events across sources using subsearches, join, and transaction grouping.
-- Subsearch: errors only from hosts that also logged a deploy eventindex=app_logs level=ERROR[ search index=deploy_logs event="deploy_start" earliest=-1h | fields host | format ]-- Join two indexes on a shared correlation idindex=web_logs| join type=inner request_id [ search index=app_logs | fields request_id, error_code ]| table _time request_id status error_code-- Group related events into a session/transactionindex=web_logs| transaction session_id maxspan=30m maxpause=5m| where duration > 60| table session_id duration eventcount
stats vs eventstats vs streamstats
Three aggregation commands with different output shapes — collapsing, enriching, or running cumulatively.
-- stats: collapses events into one summary row per groupindex=web_logs | stats count avg(response_time) by endpoint-- eventstats: adds the aggregate back onto every original event (no collapse)index=web_logs| eventstats avg(response_time) as avg_rt by endpoint| where response_time > avg_rt * 2-- streamstats: running/cumulative aggregate as events flow throughindex=web_logs| sort _time| streamstats count as running_count window=100 by endpoint
Correlation Searches: append & map
Combining results of separate searches and running a per-result subsearch, common in security use-case correlation.
-- append: stack results of two unrelated searches into one tableindex=firewall_logs action=blocked| stats count by src_ip| append [ search index=auth_logs action=failed_login | stats count by src_ip ]-- map: run a subsearch once per result row (use sparingly, expensive)index=auth_logs action=failed_login| stats count by user| where count > 5| map search="search index=auth_logs user=$user$ | table _time action src_ip"
Architecture & Admin Concepts
Concepts beyond writing individual searches — relevant to running Splunk at scale.
- indexer clustering- Replicates buckets across peer indexers for high availability and search-time redundancy
- search head clustering- Shares knowledge objects and distributes search load across multiple search heads
- bucket lifecycle (hot/warm/cold/frozen)- Buckets age from writable hot, to searchable warm/cold, to archived/deleted frozen based on retention policy
- SPL2- Newer unified pipeline query language used by Splunk Cloud's dashboard studio and data pipelines
- summary indexing- Pre-aggregating expensive searches on a schedule into a lightweight summary index for fast dashboards
- data model acceleration- Pre-builds tsidx summaries for a data model so pivot/tstats searches run near-instantly
- tstats- Runs statistics directly over indexed tsidx fields/accelerated data models, far faster than a raw index search
Accelerated Search with tstats
Querying an accelerated data model directly for high-performance dashboards instead of scanning raw events.
| tstats summariesonly=true count FROM datamodel=Web WHERE Web.status=500 BY Web.host, _time span=1h| rename Web.host as host| timechart span=1h sum(count) by host
Push field extraction and filtering as early in the pipeline as possible (before stats/timechart) — SPL evaluates left to right, and reducing the event set early dramatically improves search performance on large indexes.
