splunk-ref.md

Splunk Reference

Tips

1. Check your timeframe
2. Use an index if possible index=main
3. Start simple
4. Test your query after each change
5. Use shift+enter to add a new line
6. AND is implied between commands

Filtering

Task	Query
Get everything	*
Get “error”	error
Get “error” but not "exception"	error NOT exception
Get “error” with “bob” (AND)	error bob
Get “error” or “exception” (OR)	error OR exception
Get “ERROR”	CASE(ERROR)
Get IP Addr messages (regex)	| regex _raw="(?<!\d)10\.\d{1,3}\.\d{1,3}\.\d{1,3}(?!\d)"

Formatting/Organizing

Task	Query
Table time and message (readable)	| table _time, _raw
Sort by time	| sort _time
Descending sort by count	| sort -count

Fields

Task	Query
Limit to time and raw	| fields _time, _raw
Extract a field using regex	| rex field=_raw .*Code=(?<code>.).\*
Extract fields using examples	| erex date examples=“2021-01-01”
Create a field	| eval container=replace(sourcetype, kube, "")
Rename a field	| rename source as container

Tables/Charts (Group by)

Task	Query
Get counts of errors by message	error | stats count by _raw
Get counts of by status and host	| stats count BY status, host
Get chart by status and host	| chart count BY status, host
Get errors over time	error | timechart count by _raw

Misc

Task	Query
List indicies	* | dedup index | table index
Get a stack trace	| transaction startswith=CASE(ERROR) maxevents=250 mvlist=true