I get asked some form of this question often and I know what my answer is but I am curious about others. What is your opinion of the top 10 most powerful SPL command that every expert splunk user or wannabe should know well and what is on "off the beaten path that you find occasionally invaluable?
I am not an expert but these commands are my bread and butter to doing things and accomplish the objectives.
stats
, timechart
, streamstats
, tstats
,append
, map
, transpose
, rex
, bin
, transaction
And as a command is very easy to understand but the power that has all the functions of eval
is where the magic happens.
Is transaction
necessary?
If you want to have in one event a succession of events evaluated with a beginning or an end with a defined control of span or limit of times, yes. If not *stats are always better 😄
makeresults
@ Splunk>Answers
I didn't expect to use that much.
It is convenient to create logs freely.
Do not forget about windbag
and gentimes
!
I have never used windbag
yet.
gentimes
is difficult to use.
Agree with the stats family, but not just "use stats" but "how to properly use stats" (to get rid of joins/append and other inefficient statements).
TERM (for faster matching if your data supports it)
IN (reduction of "OR"s and easier readability)
Finally, REX/REGEX. If your data is barely structured (looking at you kubernetes and rancher debug logs) , and you are good at rex/regex, then you can you interrogate the data and bend it to your will.
*stats
!
stats
, eventstats
, streamstats
take Splunk from being just a search engine to a tool for in-depth analysis