### Basic Splunk Search Example

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/use-the-search-app/anatomy-of-a-search

This example demonstrates a typical Splunk search pipeline. It starts by filtering events by sourcetype and error, then identifies the top users, and finally removes the percentage column from the results.

```splunk
sourcetype=syslog ERROR | top user | fields - percent
```

--------------------------------

### Example Search with Syntax Highlighting

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/use-the-search-app/help-reading-searches/syntax-highlighting

This example demonstrates a typical Splunk search query where syntax highlighting would be applied to improve readability.

```spl
sourcetype=access_* | timechart count(eval(action=purchase)) BY productName usenull=false useother=false
```

--------------------------------

### Example Search Qualifying for Optimization

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/optimize-searches/built-in-optimization

This example demonstrates a search that meets the criteria for the stats/chart/timechart to tstats optimization, featuring an explicit search command followed by a stats command.

```splunk
index=_internal sourcetype=splunkd | stats count
```

--------------------------------

### Example Search with Stats Command

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/retrieve-events/event-sampling

This example shows a search that uses the `stats` command. When event sampling is enabled, the results from `sum(x)` will only reflect the sampled events, not the entire dataset. To approximate the true sum, you would need to scale the returned value by the sampling ratio.

```splunk search
... | stats sum(x)
```

--------------------------------

### Example Search for Event Type/Tag Optimization

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/optimize-searches/built-in-optimization

This example search demonstrates how event type and tag optimization works. Without optimization, all event types and tags are uploaded, even if only a specific tag is needed.

```splunk search
index=_internal | search tag=foo | stats count by host
```

--------------------------------

### CLI command example for exporting raw data

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/export-search-results/export-data-using-the-cli

This example exports 200,000 events in raw data format from the _internal index within a specified time range to a local file. Adjust the earliest and latest times as needed.

```bash
splunk search "index=_internal earliest=09/14/2024:23:59:00 latest=09/16/2024:01:00:00 " -output rawdata -maxout 200000 > c:/test123.dmp
```

--------------------------------

### Scheduled Search Dispatch Directory Name Example 2

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/manage-jobs/dispatch-directory-and-search-artifacts

This example shows a scheduled search for a remote peer, run by the scheduler with 'admin' user context in the 'search' app.

```text
remote_sh01_scheduler__admin__search__foo2_at_1347457920_79152a9a8bf33e5e
```

--------------------------------

### Snap to beginning of the day

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/specify-time-ranges/specify-time-modifiers-in-your-search

Use '@d' to snap the earliest time to the beginning of the day. This example sets the earliest time to the start of the day two days prior.

```splunk search
earliest=-2d@d
```

--------------------------------

### Splunk Search with a Subsearch Example

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/subsearches

This example demonstrates a Splunk search where a subsearch is used to identify the top client IPs from purchase events and then uses those IPs to filter the main search for purchase events.

```splunk
sourcetype=access_* status=200 action=purchase [search sourcetype=access_* status=200 action=purchase | top limit=1 clientip | table clientip] | stats count, dc(productId), values(productId) by clientip
```

--------------------------------

### Example search command for dedup

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/manage-jobs/view-search-job-properties

This is an example of a 'dedup' search command used to illustrate execution costs in the Search Job Inspector. It is run over 'All time'.

```splunk
* | dedup punct
```

--------------------------------

### Search command example with AND and OR

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/expressions-and-predicates/boolean-expressions-with-logical-operators

Demonstrates how the `search` command processes AND and OR operators. The AND operator is implied and OR is evaluated before AND.

```spl
host="www1" AND status=200 OR action="addtocart"
```

```spl
host="www1" AND (status=200 OR action="addtocart")
```

--------------------------------

### Commented SPL search example

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/use-the-search-app/add-comments-to-searches

A multi-line example of a Splunk search with inline comments, illustrating how comments can be used to explain each part of a complex query.

```spl
sourcetype=access_* status=200 ```Get all successful website access events.```
| stats count AS views count(eval(action="addtocart")) AS addtocart count(eval(action="purchase")) AS purchases by productName ```Create counts of site views, add-to-cart actions, and purchase actions. Break them out by product name. ```
| eval cartToPurchases=(purchases/views)*100 ```Find the ratio of site views to purchases.```
|eval cartToPurchases=(purchases/addtocart)*100 ```Find the ratio of add-to-cart actions to purchases.```
| table productName views addtocart purchases viewsToPurchases cartToPurchases ```Put all this data into a table.```
| rename productName AS "Product Name", views AS "Views", addtocart AS "Add To Cart", purchases AS "Purchases" ``` Rename some table columns.```
```

--------------------------------

### Search command examples with AND NOT and NOT OR

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/expressions-and-predicates/boolean-expressions-with-logical-operators

Demonstrates combining NOT operators with AND and OR for more complex exclusions. Parentheses can clarify the order of operations for multiple exclusions.

```spl
host="www1" NOT status=200 AND NOT status=505
```

```spl
host="www1" NOT (status=200 OR status=505)
```

--------------------------------

### Where command example with AND and OR

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/expressions-and-predicates/boolean-expressions-with-logical-operators

Illustrates how the `where` command processes AND and OR operators. AND is evaluated before OR, differing from the `search` command.

```spl
...| where host="www1" AND status=200 OR action="addtocart"
```

```spl
...| where (host="www1" AND status=200) OR action="addtocart"
```

--------------------------------

### Simple Predicate Pushdown Example (Before Optimization)

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/optimize-searches/built-in-optimization

This search demonstrates a scenario where a 'where' command is applied late in the search pipeline, processing many events before filtering.

```splunk
sourcetype=access* (status=401 OR status=403) | lookup usertogroup user OUTPUT group | where src_category="email_server"
```

--------------------------------

### Search events from the previous month

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/specify-time-ranges/specify-time-modifiers-in-your-search

This example searches for events from the start of the previous month up to the start of the current month.

```splunk search
earliest=-mon@mon latest=@mon
```

--------------------------------

### Match Terms with Wildcards using TERM()

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/search-primer/use-case-and-term-to-match-phrases

The TERM directive can be used with wildcards to match patterns. This example searches for terms starting with '%ASA-1'.

```splunk
TERM(%ASA-1*)
```

--------------------------------

### Execute Java SDK export search

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/export-search-results/export-data-using-the-splunk-sdks

Run the Java SDK export example from the command line to export data from the 'main' index. Ensure to delete 'export.out' if rerunning.

```bash
java -jar dist/examples/export.jar main --username="admin" --password="changeme"
```

--------------------------------

### Snap to nearest hour

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/specify-time-ranges/specify-time-modifiers-in-your-search

Use '@h' to snap the earliest time to the beginning of the hour. This example sets the earliest time to the start of the previous hour.

```splunk search
earliest=-h@h
```

--------------------------------

### View all running processes and arguments (*nix)

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/manage-jobs/manage-splunk-enterprise-jobs-from-the-os

Use the `top` command to display all running processes and their arguments. This helps in identifying Splunk search processes.

```bash
top
```

--------------------------------

### Example Search Command Order

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/search-overview/types-of-commands

Illustrates the order of commands in a search pipeline, highlighting how distributable streaming commands are processed on indexers and non-streaming commands shift processing to the search head.

```spl
search... | lookup... | where... | eval... | sort... | where... |...
```

--------------------------------

### Run a non-transforming search in Splunk

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/create-statistical-tables-and-chart-visualizations/open-a-non-transforming-search-in-pivot-to-create-tables-and-charts

This is an example of a non-transforming search that returns event lists. Use this type of search as a starting point before opening it in Pivot to create tables and charts.

```splunk
sourcetype=access_* status=200 action=purchase
```

--------------------------------

### Complex Predicate Pushdown Example (Before Optimization)

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/optimize-searches/built-in-optimization

This search shows an 'eval' command that assigns a default value, followed by a 'where' command. The 'where' command is processed after the 'eval'.

```splunk
... | eval x=if(isnull(x) OR x=="", "missing", x) | where x = "hello"
```

--------------------------------

### Specify groups of indexes using wildcards

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/retrieve-events/retrieve-events-from-indexes

Use a wildcard (*) to search groups of indexes. For example, 'index=mai*' searches indexes starting with 'mai'. Use '_*' to match internal indexes.

```Splunk Search
index=mai*
```

```Splunk Search
index=_*
```

--------------------------------

### Search Seven Days Ago Before Day Start, Ending at Day Start

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/specify-time-ranges/specify-time-modifiers-in-your-search

Searches for events starting three hours before midnight seven days ago and ending at midnight seven days ago.

```splunk search
earliest=-7d@d-3h latest=-7d@d
```

--------------------------------

### Initial timechart attempt

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/create-statistical-tables-and-chart-visualizations/build-a-chart-of-multiple-data-series

This is an example of a standard `timechart` command that Splunk does not support for multiple data series. It is provided for contrast with the working solution.

```splunk search
index=application_servers 
| timechart sum(handledRequests) avg(sessions) by source
```

--------------------------------

### Projection Elimination Example

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/optimize-searches/built-in-optimization

This example shows how Splunk eliminates an unused 'c' field generated by an eval command, optimizing the search.

```splunk
index=_internal | eval c = x * y / z | stats count BY a, b
```

```splunk
index=_internal | stats count BY a, b
```

--------------------------------

### Subsearch example for passing a single value

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/subsearches/change-the-format-of-subsearch-results

This example shows how to extract a single 'clID' value from a subsearch and pass it to the main search.

```splunk search
index=myindex [search index=myindex host=myhost MyName | top limit=1 clID | fields clID ]
```

--------------------------------

### Complex Predicate Pushdown Example (After Optimization)

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/optimize-searches/built-in-optimization

Predicate pushdown optimizes this by moving the 'where x = "hello"' criteria before the 'eval' command, allowing for earlier filtering.

```splunk
... | where x = "hello" | eval x=if(isnull(x) OR x=="", "missing", x)
```

--------------------------------

### Prepare data for multiple series with eval, makemv, and mvexpand

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/create-statistical-tables-and-chart-visualizations/build-a-chart-of-multiple-data-series

This sequence of commands prepares the data for creating multiple series. It uses `eval` to define series names, `makemv` to create a multi-valued field, and `mvexpand` to create separate rows for each series.

```splunk search
... | eval s1="handledRequests sessions" | makemv s1 | mvexpand s1
```

--------------------------------

### Search Seven Days Ago from Day Start for Two Hours

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/specify-time-ranges/specify-time-modifiers-in-your-search

Finds events from seven days ago, starting at midnight of that day and spanning a two-hour duration.

```splunk search
earliest=-7d@d latest=-7d@d+2h
```

--------------------------------

### Initial Search for HTTP Errors

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/retrieve-events/drill-down-on-event-details

Use this search to find HTTP errors starting with 4 in the Apache web access logs. This is the starting point for demonstrating drilldown actions.

```splunk
sourcetype=access_* status=4*
```

--------------------------------

### Add IP addresses using a DNS lookup

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/evaluate-and-manipulate-fields/use-lookup-to-add-fields-from-lookup-tables

Use the `lookup` command to match hostnames in your events to a lookup table (e.g., `dnslookup`) and output the corresponding IP addresses. The `AS` clause maps the event field `clienthost` to the lookup field `host`.

```splunk
... | lookup dnslookup clienthost AS host OUTPUT clientip
```

--------------------------------

### Saved Search Dispatch Directory Name Example 2

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/manage-jobs/dispatch-directory-and-search-artifacts

This example shows a saved search named with a user context 'somebody', in the 'search' app, using a hashed search string.

```text
somebody__somebody__search_RMD5473cbac83d6c9db7_1347455134.20
```

--------------------------------

### Chart Sum of Bytes Over Client IP, Split by Host

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/create-statistical-tables-and-chart-visualizations/create-charts-that-are-not-necessarily-time-based

This example generates a chart showing the sum of kilobytes processed by each `clientip`, split by `host`. The `bytes` value is on the y-axis, `clientip` on the x-axis, and the data is broken out by host. Format as a stacked bar chart.

```splunk
sourcetype=access_* | chart sum(bytes) over clientip by host
```

--------------------------------

### Set up Python environment for Splunk SDK

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/export-search-results/export-data-using-the-splunk-sdks

Add the Splunk SDK library to your Python path. Ensure the splunklib is stored in the \"lib\" directory of your Splunk app.

```python
sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "lib"))
import splunklib.client as client
import splunklib.results as results
from __future__ import print_function
```

--------------------------------

### Comment before a generating command (error example)

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/use-the-search-app/add-comments-to-searches

Shows an example of a comment placed before a generating command, which will cause the search to fail or produce incorrect results. Generating commands include 'tstats', 'makeresults', 'multisearch', and 'gentimes'.

```spl
````This search returns an error```` | tstats count WHERE host=x BY source
```

--------------------------------

### Simple Predicate Pushdown Example (After Optimization)

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/optimize-searches/built-in-optimization

With predicate pushdown, the 'src_category="email_server"' criteria is moved before the 'lookup', significantly reducing the number of events processed by the lookup.

```splunk
sourcetype=access* (status=401 OR status=403) src_category="email_server" | lookup usertogroup user OUTPUT group
```

--------------------------------

### Count purchases for a specific shopper using `stats` command

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/subsearches

This search counts the total purchases, distinct products purchased, and lists the product IDs for a specific VIP shopper identified by their client IP. It uses `count()`, `dc()` (distinct_count), and `values()` functions.

```splunk
sourcetype=access_* status=200 action=purchase clientip=87.194.216.51 | stats count, dc(productId), values(productId) by clientip
```

--------------------------------

### Define transaction start condition using eval expression

Source: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/group-and-correlate-events/identify-and-group-events-into-transactions

Use the `startswith` option with an `eval` expression to define a custom condition for starting a new transaction. This allows for more complex logic based on field values.

```splunk search
startswith=eval(speed_field < max_speed_field)
```