Author: k A

The stats command is used to calculate summary statistics on the results of a search or the events retrieved from an index. The stats command works on the search results…

Many times, we are interested in finding the most common values available in a field. The top command in Splunk helps us achieve this. It further helps in finding the count and…

The sort command sorts all the results by specified fields. The missing fields are treated as having the smallest or largest possible value of that field if the order is descending or…

Splunk Enterprise monitors and indexes the file or directory as new data appears. You can also specify a mounted or shared directory, including network file systems, as long as Splunk…

The charts created in Splunk has many features to customize them as per the user need. These customizations help in displaying the data completely or changing the interval for which…

Removing data from Splunk is possible by using the delete command. We first create the search condition to fetch the events we want to mark for delete. Once the search condition is…

A Splunk app is an extension of Splunk functionality which has its own in-built UI context to serve a specific need. Splunk apps are made up of different Splunk knowledge…

Tags are used to assign names to specific field and value combinations. These fields can be event type, host, source, or source type, etc. You can also use a tag…

Many times, we will need to make some calculations on the fields that are already available in the Splunk events. We also want to store the result of these calculations…