Splunk Enterprise Search Manual

https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2
Admin
The Splunk Enterprise Search Manual provides comprehensive documentation and guidance for using the...
Tokens:93,090
Snippets:1,897
Trust Score:10
Update:2 months ago
Show doc for...
Tokens:
Raw
### Example object endpoint URL

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/export-search-results/export-data-using-the-splunk-rest-api

An example URL structure for accessing saved searches for a specific user and app.

```text
https://localhost:8089/servicesNS/admin/search/saved/searches/
```

--------------------------------

### Sequential Subsearches Example

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/subsearches/about-subsearches

Demonstrates sequential subsearches processed from left to right.

```Splunk SPL
index=* OR index=_* | [search index=* | stats count by customerID] | [search index=* | stats by productName]
```

--------------------------------

### Keyword and phrase search examples

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/search-primer

Examples of searching for single keywords, multiple keywords, and exact phrases.

```SPL
web
```

```SPL
error
```

```SPL
web error
```

```SPL
"web error"
```

--------------------------------

### Simple Predicate Pushdown Example

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/optimize-searches/built-in-optimization

Demonstrates reordering search processing to apply filters before lookups.

```Splunk SPL
sourcetype=access* (status=401 OR status=403) | lookup usertogroup user OUTPUT group | where src_category="email_server"
```

```Splunk SPL
sourcetype=access* (status=401 OR status=403) src_category="email_server" | lookup usertogroup user OUTPUT group
```

--------------------------------

### Example Search Pipeline

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/search-overview/types-of-commands

A sample search pipeline demonstrating the transition from distributable streaming commands to non-streaming commands.

```SPL
search... | lookup... | where... | eval... | sort... | where... |...
```

--------------------------------

### Example Transforming Search

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/optimize-searches/built-in-optimization

A sample search demonstrating how tags are used in a transforming search.

```Splunk SPL
index=_internal | search tag=foo | stats count by host
```

--------------------------------

### Example Product ID Data

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/search-primer/wildcards

A list of product IDs demonstrating how punctuation affects indexing and wildcard matching.

```text
DB-SG-G01
DC-SG-G02
MB-AG-G07
MB-AG-T01
SC-MG-G01
SF-BVS-G01
SG-SH-G05
WC-SH-A02
WC-SH-G04
```

--------------------------------

### Example SPL search query

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/use-the-search-app/help-reading-searches/syntax-highlighting

A sample search query demonstrating the use of timechart, eval, and various arguments.

```SPL
sourcetype=access_* | timechart count(eval(action=purchase)) BY productName usenull=false useother=false
```

--------------------------------

### Define sampleRatio in Simple XML

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/retrieve-events/event-sampling

Example of a dashboard panel configuration in Simple XML that includes a sampleRatio element.

```xml
<event>
  <title>sample events</title>
  <search>
     <query>buttercupgames</query>
     <earliest>@d</earliest>
     <latest>now</latest>
     <sampleRatio>500</sampleRatio>
  </search>
</event>
```

--------------------------------

### Search events starting three hours before the beginning of the day seven days ago

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/specify-time-ranges/specify-time-modifiers-in-your-search

Combines rounding to the start of the day with a negative offset to shift the search window start time.

```text
earliest=-7d@d-3h latest=-7d@d
```

--------------------------------

### Event segmentation example

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/search-primer/event-segmentation-and-searching

Demonstrates how a raw log entry is broken down into individual tokens based on major breakers.

```text
91.205.189.15 - - 13/Jun/2025:18:22:16 GET /oldlink itemId=EST-14 JSESSIONID=SD6SL7FF7ADFF53113 HTTP 1.1 ```
91.205.189.15
-
-
13/Jun/2025:18:22:16
GET
/oldlink
itemId=EST-14
JSESSIONID=SD6SL7FF7ADFF53113
HTTP
1.1
```
```

--------------------------------

### Export Data via Java SDK CLI

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/export-search-results/export-data-using-the-splunk-sdks

Examples for running the Java export application via command line.

```bash
java -jar dist/examples/export.jar main --username="admin" --password="changeme"
```

```bash
java -jar dist/examples/export.jar main --search="search sourcetype=access_*" json
```

--------------------------------

### Nested Subsearches Example

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/subsearches/about-subsearches

Demonstrates how nested subsearches are processed from the innermost to the outermost.

```Splunk SPL
index=* OR index=_* 
[search index=* | stats count by component 
| search [search index=* | stats count by user 
| search [search index=* | stats by ipaddress]]]
```

--------------------------------

### Implicit search command usage

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/search-primer

Demonstrates the implicit nature of the search command at the start of a pipeline.

```SPL
host=webserver*
```

```SPL
search host=webserver*
```

--------------------------------

### Searching for Product IDs

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/search-primer/wildcards

Example of a failed wildcard search and the recommended approach using explicit OR statements.

```text
productID=S*G01
```

```text
productID=SC-MG-G01 OR productID=SF-BVS-G01
```

--------------------------------

### Generating Command Error Example

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/search-overview/types-of-commands

Demonstrates a search failure caused by placing a comment before a generating command.

```text
| ```This search returns an error``` | tstats count WHERE host=x BY source
```

--------------------------------

### Basic Subsearch Example

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/subsearches/about-subsearches

Uses a subsearch to identify the most active host and pass it as a filter to the main search.

```Splunk SPL
sourcetype=syslog  [search sourcetype=syslog earliest=-1h | top limit=1 host | fields + host]
```

--------------------------------

### Default subsearch table format

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/subsearches/change-the-format-of-subsearch-results

Example of a table structure returned by a subsearch before the format command is applied.

```text
| field1  | field2  |
            -------------------
event/row1 | val1_1  | val1_2  |
event/row2 | val2_1  | val2_2  |
```

--------------------------------

### Predicate flip normalization example

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/optimize-searches/search-normalization

Demonstrates the transformation of a search string where the field value precedes the field name into a normalized format.

```SPL
index=main | where "error"=status
```

```SPL
index=main | where (status == "error")
```

--------------------------------

### Calculate statistics with event sampling

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/retrieve-events/event-sampling

Example of a stats command that requires scaling when event sampling is active.

```text
... | stats sum(x)
```

--------------------------------

### Export specific events to a file

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/export-search-results/export-data-using-the-cli

Example command to export 200,000 events from the _internal index within a specific time range to a file.

```bash
splunk search "index=_internal earliest=09/14/2024:23:59:00 latest=09/16/2024:01:00:00 " -output rawdata -maxout 200000 > c:/test123.dmp
```

--------------------------------

### Example of event data segmentation

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/search-primer/event-segmentation-and-searching

Shows a raw event string containing an IP address, timestamp, and HTTP request details.

```text
91.205.189.15 - - [13/Jun/2025:18:22:16] "GET /oldlink?itemId=EST-14&JSESSIONID=SD6SL7FF7ADFF53113 HTTP 1.1"
```

--------------------------------

### Example of major breaker segmentation

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/search-primer/event-segmentation-and-searching

Demonstrates how an IP address and timestamp string is split into segments based on major breakers.

```text
91.205.189.15
-
[13/Aug/2022:18:22:16]
```

--------------------------------

### Local Ad Hoc Search Directory Names

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/manage-jobs/dispatch-directory-and-search-artifacts

Examples of directory naming for standard and real-time ad hoc searches.

```text
1347457078.35
```

```text
rt_1347456938.31
```

```text
1347457148.46
```

```text
subsearch_1347457148.46_1347457148.1
```

--------------------------------

### Subsearch usage example

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/subsearches/change-the-format-of-subsearch-results

A practical example of using a subsearch to filter results in a primary search.

```splunk
index=myindex [search index=myindex host=myhost MyName | top limit=1 clID | fields clID ]
```

--------------------------------

### View active processes in top

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/manage-jobs/manage-splunk-enterprise-jobs-from-the-os

Use the top command followed by the 'c' key to display processes with their full command-line arguments.

```bash
> top
> c
```

--------------------------------

### String Literal Expressions

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/expressions-and-predicates

Examples of string literals and escaping backslashes in paths.

```SPL
"surname"
```

```SPL
"C:\\windows"
```

```SPL
"C:\\windows\\temp"
```

```SPL
surname
```

```SPL
C:\windows
```

```SPL
C:\windows   emp
```

```SPL
"C:\\windows\\temp"
```

--------------------------------

### Use expressions in SPL commands

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/expressions-and-predicates/types-of-expressions

Examples of using expressions with eval, where, and fieldformat commands.

```SPL
...| eval diameter=circumference*3.14
```

```SPL
... | where status in("400", "401", "403", "404")
```

```SPL
... | fieldformat count=tostring(count, "commas")
```

--------------------------------

### Initiate a subsearch with the map command

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/subsearches/about-subsearches

Demonstrates using the map command to execute a subsearch across all indexes.

```Splunk SPL
|makeresults 
|map search="search index=* OR index=_* earliest=0 latest=now"
```

--------------------------------

### GET /services/search/jobs/{sid}/results

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/export-search-results/export-data-using-the-splunk-rest-api

Retrieves the results of a previously initiated search job.

```APIDOC
## GET /services/search/jobs/{sid}/results

### Description
Exports the search results for a specific job ID to a file. The output format can be specified using the output_mode parameter.

### Method
GET

### Endpoint
/services/search/jobs/{sid}/results

### Query Parameters
- **output_mode** (string) - Optional - The format of the output. Supported values: atom, csv, json, json_cols, json_rows, raw, xml.
```

--------------------------------

### Configure [realtime] stanza in limits.conf

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/search-and-report-in-real-time/how-to-restrict-usage-of-real-time-search

Defines the configuration parameters for real-time search indexer limits.

```ini
[realtime] 
queue_size = <int>
blocking = [0|1] 
max_blocking_secs = <int>
indexfilter = [0|1]
```

--------------------------------

### Inefficient search example

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/optimize-searches/about-search-optimization

A search that performs lookups and evaluations on the entire dataset before filtering.

```Splunk SPL
sourcetype=my_source
| lookup my_lookup_file D OUTPUTNEW L 
| eval E=L/T 
| search A=25 L>100 E>50
```

--------------------------------

### Real-time Search Directory Name

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/manage-jobs/dispatch-directory-and-search-artifacts

Example of a directory name for a real-time ad hoc search.

```text
rt_1347456938.31
```

--------------------------------

### Calculate Percentage and Size Metrics

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/search-examples-and-walkthroughs/calculate-sizes-of-dynamic-fields

Computes percentage distributions and converts byte values into megabytes using eval.

```SPL
| eval PercentOfTotalEvents=round(NumOfValuesPerField/TotalEvents*100,2)
| eval PercentOfTotalBytes=round(SumOfBytesInField/TotalBytes*100,2)
| eval ConsumedMB=SumOfBytesInField/1024/1024
| eval TotalMB=TotalBytes/1024/1024
```

--------------------------------

### Remote Search Directory Name

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/manage-jobs/dispatch-directory-and-search-artifacts

Example of a directory name for a search originating from a remote peer.

```text
remote_sh01_scheduler__admin__search__foo2_at_1347457920_79152a9a8bf33e5e
```

--------------------------------

### Search from beginning of week to now

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/specify-time-ranges/specify-time-modifiers-in-your-search

Searches for events starting from the Sunday of the current week to the current time.

```text
eventtype=webaccess error earliest=@w0 latest=now
```

--------------------------------

### Define connection parameters

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/export-search-results/export-data-using-the-splunk-sdks

Sets the host, port, and credentials required to connect to the Splunk instance.

```python
HOST = "localhost"
PORT = 8089
USERNAME = "admin"
PASSWORD = "changeme"
```

--------------------------------

### Define earliest and latest time modifiers

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/specify-time-ranges/specify-time-modifiers-in-your-search

Basic syntax for setting the start and end boundaries of a search.

```text
earliest=<time_modifier>
latest=<time_modifier>
```

--------------------------------

### Run a search job via REST API

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/export-search-results/export-data-using-the-splunk-rest-api

Initiate a search job by sending a POST request to the jobs endpoint.

```bash
curl -k -u admin:changeme \
     https://localhost:8089/services/search/jobs/ -d search="search sourcetype=access_* earliest=-7d"
```

--------------------------------

### Complex Subsearch Example

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/subsearches/about-subsearches

Shows a subsearch containing another subsearch within a search command.

```Splunk SPL
index=foo error [ search index=bar baz [search index=* | stats count by user | search count>100] | stats count by host ]
```

--------------------------------

### Identify the most active host

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/subsearches/about-subsearches

A subsearch example that retrieves the single most active host from the last hour.

```Splunk SPL
sourcetype=syslog earliest=-1h | top limit=1 host | fields host
```

--------------------------------

### Configure default sampling ratio in ui-prefs.conf

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/retrieve-events/event-sampling

Set the default sampling ratio by modifying the display.prefs.customSampleRatio property within the [Preference options] stanza of the local ui-prefs.conf file.

```ini
[Preference options]
display.prefs.customSampleRatio = <positive_integer>
```

--------------------------------

### Optimized tstats search example

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/optimize-searches/built-in-optimization

Shows the internal representation of a search after the stats to tstats optimization is applied.

```splunk
| tstats prestats=true summariesonly=false allow_old_summaries=false include_reduced_buckets=true count WHERE (index=_internal sourcetype=splunkd) | stats count
```

--------------------------------

### Generate a real-time top IP address report

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/search-and-report-in-real-time/real-time-searches-and-reports-in-splunk-web

Use the top command to display a real-time table of client IP addresses as data streams in.

```text
sourcetype=access_* | top clientip
```

--------------------------------

### Run a basic real-time search

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/search-and-report-in-real-time/real-time-searches-and-reports-in-the-cli

Use the rtsearch command to initiate a real-time search in the CLI.

```bash
./splunk rtsearch 'eventtype=pageview'
```

--------------------------------

### Search by event type

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/retrieve-events/classify-and-group-similar-events

Examples of filtering events by a specific event type and host or user.

```text
host=target eventtype=failed_login
```

```text
user=suspicious eventtype=failed_login
```

--------------------------------

### Connect and execute export search

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/export-search-results/export-data-using-the-splunk-sdks

Establishes a service connection and initiates an export search using the Splunk Python SDK.

```python
service = client.connect(
    host=HOST,
    port=PORT, 
    username=USERNAME,
    password=PASSWORD)

rr = results.ResultsReader(service.jobs.export("search index=_internal earliest=-1h | head 5"))
```

--------------------------------

### Predicate Merge with Search Commands

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/optimize-searches/built-in-optimization

Demonstrates how the predicate merge optimization combines multiple search commands into a single predicate.

```Splunk SPL
index=main |  search a > 10  AND  fieldA = "New"
```

```Splunk SPL
index=main AND a > 10  AND fieldA = "New"
```

--------------------------------

### Multi-series chart workaround using stats and xyseries

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/create-statistical-tables-and-chart-visualizations/build-a-chart-of-multiple-data-series

A search pipeline that uses bin, stats, and xyseries to manually construct multiple data series for a timechart.

```Splunk SPL
index=application_servers 
| bin _time 
| stats sum(handledRequests) as hRs, avg(sessions) as ssns by _time, source 
| eval s1="handledReqs sessions" 
| makemv s1 
| mvexpand s1 
| eval yval=case(s1=="handledReqs",hRs,s1=="sessions",ssns) 
| eval series=source+":"+s1 
| xyseries _time,series,yval
```

--------------------------------

### Basic syntax of the dump command

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/export-search-results/export-data-using-the-dump-command

The fundamental structure for the dump command, including optional parameters for file management and formatting.

```text
dump basefilename=<string> [rollsize=<number>] [compress=<number>] [format=<string>] [fields=<comma-delimited-string>]
```
Tokens:
Raw