Archive

What are THE most important SPL commands?

Esteemed Legend

I get asked some form of this question often and I know what my answer is but I am curious about others. What is your opinion of the top 10 most powerful SPL command that every expert splunk user or wannabe should know well and what is on "off the beaten path that you find occasionally invaluable?

Communicator

I am not an expert but these commands are my bread and butter to doing things and accomplish the objectives.

stats , timechart, streamstats, tstats,append, map, transpose, rex, bin, transaction

And as a command is very easy to understand but the power that has all the functions of eval is where the magic happens.

Ultra Champion

Is transaction necessary?

0 Karma

Communicator

If you want to have in one event a succession of events evaluated with a beginning or an end with a defined control of span or limit of times, yes. If not *stats are always better 😄

0 Karma

Ultra Champion

makeresults @ Splunk>Answers

I didn't expect to use that much.
It is convenient to create logs freely.

Esteemed Legend

Do not forget about windbag and gentimes!

0 Karma

Ultra Champion

I have never used windbag yet.
gentimes is difficult to use.

0 Karma

Path Finder

Agree with the stats family, but not just "use stats" but "how to properly use stats" (to get rid of joins/append and other inefficient statements).

TERM (for faster matching if your data supports it)
IN (reduction of "OR"s and easier readability)

Finally, REX/REGEX. If your data is barely structured (looking at you kubernetes and rancher debug logs) , and you are good at rex/regex, then you can you interrogate the data and bend it to your will.

Splunk Employee
Splunk Employee

*stats!

stats, eventstats, streamstats take Splunk from being just a search engine to a tool for in-depth analysis