index=references sourcetype=spl | table command, purpose, example

Splunk Search Cheat Sheet

Beginner reference for SPL (Search Processing Language). Every example is copy-ready.

1. Search Basics

index=* keyword

index=*: search across all indexes.
keyword: match any event containing the keyword.

2. Setting Time Ranges

Using the GUI: top-right of the search screen — select Last 15 minutes, Today, etc.

Using the search command:

earliest=-15m latest=now

3. Search Modes (GUI)

Fast Mode: prioritizes speed, limits field discovery.
Smart Mode: balanced — shows relevant fields automatically.
Verbose Mode: returns all possible fields (slowest).

Change mode from the dropdown above the search bar.

4. Formatting Data

Using `table`

Display data in a clean table format.

index=web_logs | table host, status, uri_path

Using `stats`

Count, group, or aggregate data.

index=web_logs | stats count by status

stats count: counts total events.
by status: group counts by HTTP status code (example).

5. Basic Search Commands

Command	Purpose	Example
`index=`	Specify index to search	`index=web_logs`
`source=`	Filter by log source	`source="/var/log/syslog"`
`sourcetype=`	Filter by log type	`sourcetype=access_combined`
`host=`	Filter by host	`host=server01`
`fields`	Show specific fields	`\| fields host, status`

6. Pipes (|)

Use pipes to chain commands and refine data.

index=web_logs | stats count by host

7. Filtering Events

Example: find only 200 or 404 status codes.

status=200 OR status=404

8. Extracting Fields

Create custom fields using regex (advanced):

index=web_logs | rex "User:\s(?<username>\w+)"