Splunk Search

What are THE most important SPL commands?

woodcock
Esteemed Legend

I get asked some form of this question often and I know what my answer is but I am curious about others. What is your opinion of the top 10 most powerful SPL command that every expert splunk user or wannabe should know well and what is on "off the beaten path that you find occasionally invaluable?

osakachan
Communicator

I am not an expert but these commands are my bread and butter to doing things and accomplish the objectives.

stats , timechart, streamstats, tstats,append, map, transpose, rex, bin, transaction

And as a command is very easy to understand but the power that has all the functions of eval is where the magic happens.

to4kawa
Ultra Champion

Is transaction necessary?

0 Karma

osakachan
Communicator

If you want to have in one event a succession of events evaluated with a beginning or an end with a defined control of span or limit of times, yes. If not *stats are always better 😄

0 Karma

to4kawa
Ultra Champion

makeresults @ Splunk>Answers

I didn't expect to use that much.
It is convenient to create logs freely.

woodcock
Esteemed Legend

Do not forget about windbag and gentimes!

0 Karma

to4kawa
Ultra Champion

I have never used windbag yet.
gentimes is difficult to use.

0 Karma

randy_moore
Path Finder

Agree with the stats family, but not just "use stats" but "how to properly use stats" (to get rid of joins/append and other inefficient statements).

TERM (for faster matching if your data supports it)
IN (reduction of "OR"s and easier readability)

Finally, REX/REGEX. If your data is barely structured (looking at you kubernetes and rancher debug logs) , and you are good at rex/regex, then you can you interrogate the data and bend it to your will.

sduff_splunk
Splunk Employee
Splunk Employee

*stats!

stats, eventstats, streamstats take Splunk from being just a search engine to a tool for in-depth analysis

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...