Splunk – Stats Command
The stats command is used to calculate summary statistics on the results of a search or the events retrieved from an index. The stats command works on the search results…
Splunk – Top Command
Many times, we are interested in finding the most common values available in a field. The top command in Splunk helps us achieve this. It further helps in finding the count and…
Splunk – Sort Command
The sort command sorts all the results by specified fields. The missing fields are treated as having the smallest or largest possible value of that field if the order is descending or…
Splunk – Monitor Files
Splunk Enterprise monitors and indexes the file or directory as new data appears. You can also specify a mounted or shared directory, including network file systems, as long as Splunk…
Splunk – Custom Chart
The charts created in Splunk has many features to customize them as per the user need. These customizations help in displaying the data completely or changing the interval for which…
Splunk – Removing Data
Removing data from Splunk is possible by using the delete command. We first create the search condition to fetch the events we want to mark for delete. Once the search condition is…
Splunk – Apps
A Splunk app is an extension of Splunk functionality which has its own in-built UI context to serve a specific need. Splunk apps are made up of different Splunk knowledge…
Splunk – Tags
Tags are used to assign names to specific field and value combinations. These fields can be event type, host, source, or source type, etc. You can also use a tag…
Splunk – Calculated Fields
Many times, we will need to make some calculations on the fields that are already available in the Splunk events. We also want to store the result of these calculations…
Splunk – Managing Indexes
Indexing is a mechanism to speed up the search process by giving numeric addresses to the piece of data being searched. Splunk indexing is similar to the concept of indexing…