exploring-splunk

COMMAND

chart/timechart

Returns results in a tabular output for (time series)

charting.

dedup

Removes subsequent results that match.

eval

Calculates an expression. (See EVAL FUNCTIONS

table.)

fields

Removes fields from search results.

head/tail

Returns the first/last N results.

lookup

Adds field values from an external source.

rename

Renames a specified field; wildcards can be used to

specify multiple fields.

replace

Replaces values of specified fields with a specified

new value.

rex

Specifies regular expression to use to extract fields.

search

Filters results to those that match the search expres-

sion.

sort

Sorts search results by the specified fields.

stats

Provides statistics, grouped optionally by fields.

top/rare

Displays the most/least common values of a field.

transaction

Groups search results into transactions.

Filter results to only include those

… | search fail status=0

with fail in their raw text and sta-

tus=0.

Remove duplicates of results with the

… | dedup host

same host value.

Keep only search results whose _raw

… | regex _raw="(?<!\d)10.\

field contains IP addresses in the

d{1,3}\.\d{1,3}\.\d{1,3}

(?!\d)"

nonroutable class A (10.0.0.0/8).

Cluster results together, sort by their

… | cluster t=0.9

cluster_count values, and then

showcount=true | sort limit=20

-cluster_count

return the 20 largest clusters (in data

size).

Group results that have the same host

… | transaction host cookie

and cookie, occur within 30 seconds

maxspan=30s maxpause=5s

of each other, and do not have a

pause greater than 5 seconds be-

tween each event into a transaction.

Group results with the same IP ad-

… | transaction clien-

dress (clientip) and where the first

tip startswith="signon"

result contains signon and the last

endswith="purchase"

result contains purchase.

Return the first 20 results.

… | head 20

Reverse the order of a result set.

… | reverse

Sort results by ip value (in ascend-

… | sort ip, -url

ing order) and then by url value (in

descending order).

Return the last 20 results (in reverse

… | tail 20

order).

Return events with uncommon

… | anomalousvalue

values.

action=filter pthresh=0.02

Return the maximum "delay" by

… | chart max(delay) by size

"size", where "size" is broken down

bins=10

into a maximum of 10 equal sized

buckets.

Return max(delay) for each value of

… | chart max(delay) over foo

foo split by the value of bar.

by bar

Return max(delay) for each value of

… | chart max(delay) over foo

foo.

Remove all outlying numerical val-

… | outlier

ues.

Remove duplicates of results with the

… | stats dc(host)

same host value and return the total

count of the remaining results.

Return the average for each hour of

… | stats avg(*lay) by date_

any unique field that ends with the

hour

string lay (such as delay, xdelay, and

relay).

Calculate the average value of CPU

… | timechart span=1m avg(CPU)

each minute for each host.

by host

Create a timechart of the count of

… | timechart count by host

from web sources by host.

Return the 20 most common values

… | top limit=20 url

of the url field.

Return the least common values of

… | rare url

the url field.

Appendix E: Splunk Quick Reference Guide

Add Fields

Set velocity to distance / time.

… | eval velocity=distance/

time

Extract from and to fields using

… | rex field=_raw "From:

regular expressions. If a raw event

(?<from>.*) To: (?<to>.*)"

contains From: Susan To: David,

then from=Susan and to=David.

Save the running total of count in a

… | accum count as total_count

field called total_count.

For each event where count exists,

… | delta count as countdiff

compute the difference between

count and its previous value and

store the result in countdiff.

Filter Fields

Keep the host and ip fields, and

… | fields + host, ip

display them in the order: host, ip.

Remove the host and ip fields.

… | fields - host, ip

Modify Fields

Keep the host and ip fields, and dis-

… | fields + host, ip

play them in the order: host, ip.

Remove the host and ip fields.

… | fields - host, ip

Multivalued Fields

Combine the multiple values of the

… | nomv recipients

recipients field into one value.

Separate the values of the

… | makemv delim="," recipi-

recipients field into multiple field

ents | top recipients

values, displaying the top recipients.

Create new results for each value of

… | mvexpand recipients

the multivalue field recipients.

Combine each result that is identical

… | fields EventCode, Catego-

except for its RecordNumber, setting

ry, RecordNumber

| mvcombine delim=”,” Record-

RecordNumber to a multivalued field

with all the varying values.

Number

Find the number of recipient

… | eval to_count =

values.

mvcount(recipients)

Find the first email address in the

… | eval recipient_first =

recipient field.

mvindex(recipient,0)

Find all recipient values that end in

… | eval netorg_recipients

.net or .org

= mvfilter(match(recipient,

"\.net$") OR match(recipient,

"\.org$"))

Find the combination of the values of

… | eval newval =

foo, "bar", and the values of baz.

mvappend(foo, "bar", baz)

Find the index of the first recipient

… | eval orgindex =

value that matches "\.org$"

mvfind(recipient, "\.org$")

Look up the value of each event's

… | lookup usertogroup user

user field in the lookup table

output group

usertogroup, setting the event’s

group field.

Write the search results to the lookup

… | outputlookup users.csv

file users.csv.

Read in the lookup file users.csv

… | inputlookup users.csv

as search results.

Function

Description

Examples

abs(X)

Returns the absolute

abs(number)

value of X.

case(X,"Y",…)

Takes pairs of argu-

case(error == 404,

ments X and Y, where X

"Not found", error

== 500,"Internal

arguments are Boolean

Server Error", er-

expressions that, when

ror == 200, "OK")

evaluated to TRUE, re-

turn the corresponding

Y argument.

ceil(X)

Ceiling of a number X.

ceil(1.9)

cidrmatch("X",Y)

Identifies IP addresses

cidrmatch("123.132.

that belong to a subnet.

32.0/25",ip)

coalesce(X,…)

Returns the first value

coalesce(null(),

that is not null.

"Returned val",

null())

exact(X)

Evaluates an expres-

exact(3.14*num)

sion X using double

precision floating point

arithmetic.

exp(X)

Returns eX.

exp(3)

floor(X)

Returns the floor of a

floor(1.9)

number X.

if(X,Y,Z)

If X evaluates to TRUE,

if(error==200,

the result is the second

"OK", "Error")

argument Y. If X evalu-

ates to FALSE, the result

evaluates to the third

argument Z.

isbool(X)

Returns TRUE if X is

isbool(field)

Boolean.

isint(X)

Returns TRUE if X is an

isint(field)

integer.

isnotnull(X)

Returns TRUE if X is not

isnotnull(field)

NULL.

isnull(X)

Returns TRUE if X is

isnull(field)

NULL.

isnum(X)

Returns TRUE if X is a

isnum(field)

number.

isstr()

Returns TRUE if X is a

isstr(field)

string.

len(X)

This function returns the

len(field)

character length of a

string X.

like(X,"Y")

Returns TRUE if and

like(field, "foo%")

only if X is like the

SQLite pattern in Y.

ln(X)

Returns the natural log

ln(bytes)

of X.

log(X,Y)

Returns the log of the

log(number,2)

first argument X using

the second argument Y

as the base. Y defaults

to 10.

lower(X)

Returns the lowercase

lower(username)

of X.

ltrim(X,Y)

Returns X with the char-

ltrim(" ZZZabcZZ ",

acters in Y trimmed from

" Z")

the left side. Y defaults

to spaces and tabs.

match(X,Y)

Returns True, if X match-

match(field,

es the regex pattern Y.

"^\d{1,3}\.\d$")

max(X,…)

Returns the greater of

max(delay, mydelay)

the two values.

md5(X)

Returns the MD5 hash

md5(field)

of string value X.

min(X,…)

Returns the min.

min(delay, mydelay)

mvcount(X)

Returns the number of

mvcount(multifield)

values of X.

mvfilter(X)

Filters a multivalued

mvfilter(match(emai

field based on the Bool-

l, "net$"))

ean expression X.

mvindex(X,Y,Z)

Returns a subset of the

mvindex( multi-

multivalued field X from

field, 2)

start position (zero-

based) Y to Z (optional).

mvjoin(X,Y)

Given a multivalued

mvjoin(foo, ";")

field X and string delim-

iter Y, joins the individu-

al values of X using Y.

now()

Returns the current

now()

time, represented in

Unix time.

null()

Takes no arguments and

null()

returns NULL.

nullif(X,Y)

Given two arguments,

nullif(fieldA,

fields X and Y, returns

fieldB)

X if the arguments are

different; returns NULL,

otherwise.

pi()

Returns the constant pi.

pi()

pow(X,Y)

Returns XY.

pow(2,10)