### App details response example

Source: https://help.splunk.com/en/splunk-cloud-platform/administer/admin-config-service-manual/10.2.2510/administer-splunk-cloud-platform-using-the-admin-config-service-acs-api/manage-private-apps-in-splunk-cloud-platform

Example JSON response when an app is successfully installed. The status field indicates 'installed'.

```json
{ "label": "tos", "name": "tos", "status": "installed", "version": "" }
```

--------------------------------

### JSON Response Example

Source: https://help.splunk.com/en/splunk-cloud-platform/administer/admin-config-service-manual/10.3.2512/admin-config-service-acs-api-endpoint-reference

Example of a JSON response indicating app installation status.

```json
{
   "label": "pa1",
   "name": "pa1",
   "status": "installed",
   "version": "1.2.2"
}
```

--------------------------------

### SPL2 FROM Command: Start with SELECT Clause

Source: https://help.splunk.com/en/splunk-cloud-platform/search/spl2-search-reference/from-command

This example demonstrates starting an SPL2 search with the SELECT clause, followed by FROM, WHERE, and GROUP BY clauses. It achieves the same result as starting with the FROM clause.

```spl
SELECT sum(bytes) AS sum, host 
FROM main 
WHERE earliest=-5m@m 
GROUP BY host
```

--------------------------------

### SPL2 FROM Command: Start with FROM Clause

Source: https://help.splunk.com/en/splunk-cloud-platform/search/spl2-search-reference/from-command

This example demonstrates starting an SPL2 search with the FROM clause, followed by WHERE, GROUP BY, and SELECT clauses.

```spl
FROM main
WHERE earliest=-5m@m 
GROUP BY host 
SELECT sum(bytes) AS sum, host
```

--------------------------------

### Example GET Request for Applications

Source: https://help.splunk.com/en/splunk-cloud-platform/administer/admin-config-service-manual/10.3.2512/using-the-admin-config-service-acs--api/basic-setup-and-usage-concepts-for-the-admin-config-service-acs-api

This example demonstrates how to make a GET request to retrieve a list of applications installed on a Splunk Cloud Platform deployment.

```APIDOC
## Example GET Request for Applications

To retrieve a list of applications installed on your Splunk Cloud Platform deployment, send a request to the following URL:

```
https://admin.splunk.com/{stack}/adminconfig/v2/apps/victoria
```

**Method:** GET
**Endpoint:** `https://admin.splunk.com/{stack}/adminconfig/v2/apps/victoria`

**Note:** Replace `{stack}` with the URL prefix of your Splunk Cloud Platform deployment.
```

--------------------------------

### Example: Import 'main' Index

Source: https://help.splunk.com/en/splunk-cloud-platform/search/spl2-search-manual/export-import-and-namespaces/understanding-spl2-namespaces

An example of importing the 'main' index using the tilde shortcut for the `indexes` namespace.

```SPL2
import main from ~indexes
```

--------------------------------

### Retrieve a list of local Splunk applications using an authentication token

Source: https://help.splunk.com/en/splunk-cloud-platform/administer/manage-users-and-security/10.2.2510/authenticate-into-the-splunk-platform-with-tokens/use-authentication-tokens

This example accesses the /apps/local endpoint to get a list of installed applications. The response is in Atom XML format.

```bash
curl -H "Authorization: Bearer eyJraWQ..." -X GET https://10.224.100.135:34740/services/apps/local
```

```xml
<?xml-stylesheet type="text/xml" href="/static/atom.xsl"?>
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>localapps</title>
  <id>https://10.224.100.135:34740/services/apps/local</id>
  <updated>2019-02-13T23:05:24+00:00</updated>
  <generator build="7d447048a453" version="7.3.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/apps/local/_new" rel="create"/>
  <link href="/services/apps/local/_reload" rel="_reload"/>
  <opensearch:totalResults>18</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
  <entry>
    <title>alert_logevent</title>
...
  </entry>
...
</feed>
```

--------------------------------

### Start Splunk Forwarder

Source: https://help.splunk.com/en/splunk-cloud-platform/administer/admin-manual/10.2.2510/get-data-into-splunk-cloud-platform/get-nix-data-into-splunk-cloud-platform

Start the Splunk forwarder service after installation.

```bash
./splunk start
```

--------------------------------

### Start Stream Forwarder Service

Source: https://help.splunk.com/en/splunk-cloud-platform/collect-stream-data/install-and-configure-splunk-stream/8.1/install-and-configure-your-splunk-stream-forwarder/install-an-independent-stream-forwarder

Start the streamfwd service after automated installation.

```bash
sudo service streamfwd start
```

--------------------------------

### App installation success response

Source: https://help.splunk.com/en/splunk-cloud-platform/administer/admin-config-service-manual/10.2.2510/administer-splunk-cloud-platform-using-the-admin-config-service-acs-api/manage-private-apps-in-splunk-cloud-platform

This is an example of a successful app installation response from the ACS API, indicating the app has been installed.

```json
{
  "label": "pa1",
  "name": "pa1",
  "status": "installed",
  "version": "1.2.2"
}
```

--------------------------------

### Example Name Data Example

Source: https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/use-ai-toolkit/5.7.1/additional-resources/share-data-in-the-ai-toolkit

Provides an example of how the name of a Showcase example is logged.

```JSON
{
  'example_name': "'Predict Server Power Consumption'"
}
```

--------------------------------

### Example Name Example

Source: https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/use-ai-toolkit/5.7.3/additional-resources

Specifies the name of the Showcase example being executed.

```JSON
{
  'example_name': "'Predict Server Power Consumption'"
}

```

```JSON
{
  'example_name': "'Predict Server Power Consumption'"
}

```

--------------------------------

### Complete Formatter Example

Source: https://help.splunk.com/en/splunk-cloud-platform/developing-views-and-apps-for-splunk-web/10.4.2604/custom-visualizations/formatter-api-reference

An example of a `formatter.html` file demonstrating a text input for maximum value and a color picker for dial color. This showcases the usage of `<splunk-control-group>` with different input types.

```html
<form class="splunk-formatter-section" section-label="Max value"> 
    <splunk-control-group label="Maximum dial value">
        <splunk-text-input name="{{VIZ_NAMESPACE}}.maxValue" value="100">
        </splunk-text-input>
    </splunk-control-group>
</form>
<form class="splunk-formatter-section" section-label="Dial color">
    <splunk-control-group label="Color">
        <splunk-color-picker name="{{VIZ_NAMESPACE}}.mainColor" value="#f7bc38">
        </splunk-color-picker>
    </splunk-control-group>
</form>

```

--------------------------------

### Get Scheduled Times Example

Source: https://help.splunk.com/en/splunk-cloud-platform/leverage-rest-apis/rest-api-reference/10.4.2604/search-endpoints/search-endpoint-descriptions

Example of how to retrieve scheduled times for a view using earliest_time and latest_time parameters.

```APIDOC
## GET /services/scheduled/views/_ScheduledView__dashboard_live/scheduled_times

### Description
Retrieves the scheduled times for a specific view, allowing filtering by a time range.

### Method
GET

### Endpoint
/services/scheduled/views/_ScheduledView__dashboard_live/scheduled_times

### Parameters
#### Query Parameters
- **earliest_time** (string) - Required - The earliest time for the data range.
- **latest_time** (string) - Required - The latest time for the data range.

### Request Example
```bash
curl -k -u admin:admin https://localhost:8089/services/scheduled/views/_ScheduledView__dashboard_live/scheduled_times --get -d earliest_time=-5h -d latest_time=-3h
```

### Response
#### Success Response (200)
(Response structure not provided in source)
```

--------------------------------

### SPL2 'from' command example

Source: https://help.splunk.com/en/splunk-cloud-platform/search/spl2-overview/specific-differences-between-spl-and-spl2

This is an example of the SPL2 'from' command syntax, demonstrating filtering, grouping, and ordering.

```SPL2
$from2 = from my_search 
where host="www2" 
group by action 
select action, count(action) 
order by action desc
```

--------------------------------

### Example GET Request for Datasets

Source: https://help.splunk.com/en/splunk-cloud-platform/leverage-rest-apis/rest-api-reference/10.2.2510/search-endpoints

An example cURL command to retrieve datasets, filtering by kind and specifying the count.

```bash
% curl -s -u <user>:<password> -X GET 
'https://<host>:<mport>/services/orchestrator/v1/datasets?kind=view,index&count=2'
```

--------------------------------

### Form with Dropdown and Time Pickers

Source: https://help.splunk.com/en/splunk-cloud-platform/create-dashboards-and-reports/simple-xml-dashboards/10.4.2604/create-dashboards-with-simple-xml/form-examples

This example demonstrates a complete form with a dropdown for source type selection and both global and local time pickers. It illustrates how to use tokens to drive searches in different panels.

```xml
<form>
  <label>Form example: add time pickers</label>
  <fieldset autoRun="true" submitButton="false">
    <input type="dropdown" token="sourcetype_tok">
      <label>Select a source type</label>
      <default>splunkd</default>
      <choice value="splunkd">splunkd</choice>
      <choice value="splunk_web_access">splunk_web_access</choice>
      <choice value="splunkd_ui_access">splunkd_ui_access</choice>
    </input>

    <!-- Global timer. Not token is necessary -->
    <input type="time" searchWhenChanged="true">
      <label>Select time range</label>
      <default>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </default>
    </input>

  </fieldset>
  <row>
    <panel>
      <title>Source type time chart</title>
      <chart>
        <search>
          <query>index = _internal sourcetype=$sourcetype_tok$ 
            | timechart count by sourcetype</query>
        </search>
      </chart>
    </panel>
    <panel>
      <title>Source type event counter</title>

      <!-- Local timer. Use tokens to access selected time. -->
      <input type="time" token="time_tok" searchWhenChanged="true">
        <label></label>
        <default>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </default>
      </input>

      <single>
        <search>
          <query>
             index=_internal sourcetype=$sourcetype_tok$ 
             | stats count as sourcetype</query>

          <!-- Use the earliest and latest modifiers to the time input token -->
          <earliest>$time_tok.earliest$</earliest>
          <latest>$time_tok.latest$</latest>

        </search>
      </single>
    </panel>
  </row>
</form>
```

--------------------------------

### App Installation Response

Source: https://help.splunk.com/en/splunk-cloud-platform/administer/admin-config-service-manual/10.2.2510/admin-config-service-acs-api-endpoint-reference

Example JSON response after initiating the installation of a Splunkbase app. It includes details about the app being processed.

```json
{
   "appID": "SplunkforPaloAltoNetworks",
   "label": "Palo Alto Networks App for Splunk",
   "name": "SplunkforPaloAltoNetworks",
   "splunkbaseID": "491",
   "status": "processing",
   "version": "7.0.4"
}
```

--------------------------------

### Complete Formatter Example with Input and Color Picker

Source: https://help.splunk.com/en/splunk-cloud-platform/developing-views-and-apps-for-splunk-web/10.2.2510/custom-visualizations/formatter-api-reference

An example demonstrating a complete formatter.html structure, including a text input for maximum dial value and a color picker for dial color.

```html
<form class="splunk-formatter-section" section-label="Max value"> <splunk-control-group label="Maximum dial value"> <splunk-text-input name="{{VIZ_NAMESPACE}}.maxValue" value="100"> </splunk-text-input> </splunk-control-group> </form> <form class="splunk-formatter-section" section-label="Dial color"> <splunk-control-group label="Color"> <splunk-color-picker name="{{VIZ_NAMESPACE}}.mainColor" value="#f7bc38"> </splunk-color-picker> </splunk-control-group> </form> ```
<form class="splunk-formatter-section" section-label="Max value">
    <splunk-control-group label="Maximum dial value">
        <splunk-text-input name="{{VIZ_NAMESPACE}}.maxValue" value="100">
        </splunk-text-input>
    </splunk-control-group>
</form>
<form class="splunk-formatter-section" section-label="Dial color">
    <splunk-control-group label="Color">
        <splunk-color-picker name="{{VIZ_NAMESPACE}}.mainColor" value="#f7bc38">
        </splunk-color-picker>
    </splunk-control-group>
</form>
```
```

--------------------------------

### Create Dashboard using REST API

Source: https://help.splunk.com/en/splunk-cloud-platform/create-dashboards-and-reports/dashboard-studio/10.2.2510/manage-dashboards/create-a-dashboard-using-rest-api-endpoints

This example demonstrates creating a dashboard named 'sample_dashboard' using the `/data/ui/views` endpoint. It includes the dashboard's name, theme, label, description, definition (with inputs, data sources, visualizations, and layout), and hidden elements configuration.

```bash
curl -k -u admin:pass https://localhost:8089/servicesNS/admin/search/data/ui/views \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'name=sample_dashboard' \
--data-urlencode 'eai:data= <dashboard version="2" theme="dark"> <label>Sample Dashboard</label> <description>Sample Description</description> <definition><![CDATA[ { "title": "Sample Dashboard", "description": "", "inputs": { "input_global_trp": { "options": { "defaultValue": "-24h@h,now", "token": "global_time" }, "title": "Global Time Range", "type": "input.timerange" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "earliest": "$global_time.earliest$", "latest": "$global_time.latest$" } } } } }, "visualizations": { "viz_FjzwMaVe": { "dataSources": { "primary": "ds_nPeRRFId" }, "options": {}, "type": "splunk.singlevalue" } }, "dataSources": { "ds_nPeRRFId": { "name": "Search_1", "options": { "query": "index=_internal \n| stats count" }, "type": "ds.search" } }, "layout": { "globalInputs": [ "input_global_trp" ], "layoutDefinitions": { "layout_1": { "options": { "height": 960, "width": 1440 }, "structure": [ { "item": "viz_FjzwMaVe", "position": { "h": 250, "w": 250, "x": 0, "y": 0 }, "type": "block" } ], "type": "absolute" } }, "tabs": { "items": [ { "label": "New tab", "layoutId": "layout_1" } ] } } } ]]></definition> <meta type="hiddenElements"><![CDATA[ { "hideEdit": false, "hideOpenInSearch": false, "hideExport": false } ]]></meta> </dashboard>'
```

```bash
curl -k -u admin:pass https://localhost:8089/servicesNS/admin/search/data/ui/views \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'name=sample_dashboard' \
--data-urlencode 'eai:data=
<dashboard version="2" theme="dark">
   <label>Sample Dashboard</label>
   <description>Sample Description</description>
   <definition><![CDATA[
{
    "title": "Sample Dashboard",
    "description": "",
    "inputs": {
        "input_global_trp": {
            "options": {
                "defaultValue": "-24h@h,now",
                "token": "global_time"
            },
            "title": "Global Time Range",
            "type": "input.timerange"
        }
    },
    "defaults": {
        "dataSources": {
            "ds.search": {
                "options": {
                    "queryParameters": {
                        "earliest": "$global_time.earliest$",
                        "latest": "$global_time.latest$"
                    }
                }
            }
        }
    },
    "visualizations": {
        "viz_FjzwMaVe": {
            "dataSources": {
                "primary": "ds_nPeRRFId"
            },
            "options": {},
            "type": "splunk.singlevalue"
        }
    },
    "dataSources": {
        "ds_nPeRRFId": {
            "name": "Search_1",
            "options": {
                "query": "index=_internal \n| stats count"
            },
            "type": "ds.search"
        }
    },
    "layout": {
        "globalInputs": [
            "input_global_trp"
        ],
        "layoutDefinitions": {
            "layout_1": {
                "options": {
                    "height": 960,
                    "width": 1440
                },
                "structure": [
                    {
                        "item": "viz_FjzwMaVe",
                        "position": {
                            "h": 250,
                            "w": 250,
                            "x": 0,
                            "y": 0
                        },
                        "type": "block"
                    }
                ],
                "type": "absolute"
            }
        },
        "tabs": {
            "items": [
                {
                    "label": "New tab",
                    "layoutId": "layout_1"
                }
            ]
        }
    }
}
   ]]></definition>
   <meta type="hiddenElements"><![CDATA[
{
   "hideEdit": false,
   "hideOpenInSearch": false,
   "hideExport": false
}
   ]]></meta>
</dashboard>'
```

--------------------------------

### SPL2 Search Starting with FROM Clause

Source: https://help.splunk.com/en/splunk-cloud-platform/search/spl2-search-reference/from-command/from-command-usage

An example of an SPL2 search that starts with the FROM clause, including WHERE, GROUP BY, SELECT, and ORDER BY clauses.

```spl
$from_example = 
FROM sample_data_index 
WHERE host="www2" 
GROUP BY action 
SELECT action, count(action) AS 'Action Count'
ORDER BY action DESC
```

--------------------------------

### Pan and Zoom Dashboard Example

Source: https://help.splunk.com/en/splunk-cloud-platform/create-dashboards-and-reports/simple-xml-dashboards/10.2.2510/simple-xml-reference

This example demonstrates how to create a dashboard with two charts that interact with each other. The first chart displays data for the last 7 days, and selecting a time range on it updates the second chart to show details for the selected period. It also shows how to capture and display token values related to the selection.

```xml
<dashboard version="1.1">
  <label>Pan and Zoom</label>
  <row>
    <panel>
      <chart>
        <title>Pan and Zoom (All source types)</title>
        <search>
          <query>
            index=_internal  |  timechart count by sourcetype
          </query>
          <earliest>-7d@h</earliest>
          <latest>now</latest>
       </search>
       <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">log</option>
        <option name="charting.chart">line</option>
        <selection>
          <set token="selection.earliest">$start$</set>
          <set token="selection.latest">$end$</set>
          <set token="start.splunk_web_access">$start.splunk_web_access$</set>
          <set token="end.splunk_web_access">$end.splunk_web_access$</set>
        </selection>
        <option name="charting.axisTitleX.text">Last 7 Days</option>
      </chart>
    </panel>
    <panel>
      <chart>
        <title>Pan and Zoom (Web access source type)</title>
        <search>
          <query>
            index=_internal sourcetype=splunk_web_access
            |  timechart count by sourcetype
          </query>
        <earliest>$selection.earliest$</earliest>
        <latest>$selection.latest$</latest>          
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.legend.placement">none</option>
        <option name="charting.legend.masterLegend">null</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">log</option>
        <option name="charting.axisTitleX.text">Selected Time Range</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <html>
        <h3>Token values for the splunk_web_access selection</h3>
        <table border="0" cellpadding="12" cellspacing="0">
          <tr>
            <td>
              <p><b>Time range (epoch time)</b></p>
              <p>
                <b>$$selection.earliest$$</b>: $selection.earliest$
                <b>$$selection.latest$$</b>: $selection.latest$
              </p>
            </td>
            <td>
              <p><b>Count at the begining and end of time range.</b></p>
              <p>
                <b>$$start.splunk_web_access$$</b>: $start.splunk_web_access$
                <b>$$end.splunk_web_access$$</b>: $end.splunk_web_access$</p>
            </td>
          </tr>
        </table>
      </html>
    </panel>
  </row>
</dashboard>
```

--------------------------------

### Start Splunk Enterprise on Linux

Source: https://help.splunk.com/en/splunk-cloud-platform/get-started/search-tutorial/10.2.2510/part-1-getting-started/launch-splunk-web

Navigate to the bin directory of your Splunk Enterprise installation and start the service using the CLI.

```bash
cd <Splunk_Enterprise_Installation_Directory>/bin
./splunk start
```