Splunk.com | SplunkBase | Support

Documentation: 3.4.1

| Print Version Contents

About this manual
- What's in this guide?
About Splunk
- About Splunk
- About Splunk licenses
Use Splunk Web
Tutorial
Add inputs
Index
Search
Use Fields
- About fields
- List of default fields
  - _index
  - _raw
  - _time
  - date_hour
  - date_mday
  - date_minute
  - date_month
  - date_second
  - date_wday
  - date_year
  - date_zone
  - eventtype
  - host
  - linecount
  - punct
  - source
  - sourcetype
  - timestamp
Tag
Report
Save, Schedule, and Alert
- Save, schedule, set alerts, and enable summary indexing
- Find and manage saved searches
  - Delete or modify saved searches
  - Display saved searches on dashboard
Use the Splunk Command Line Interface (CLI)
Search reference
Modifier reference
Search command reference
- Search commands
- Generate data
  - crawl
  - file
  - savedsearch
  - search
- Filter and re-order
  - dedup
  - head
  - localize
  - regex
  - reverse
  - set
  - sort
  - tail
  - where
- Extract
  - addinfo
  - extract (kv)
  - iplocation
  - multikv
  - rex
  - typer
  - xmlkv
- Evaluate
  - abstract
  - addtotals
  - anomalousvalue
  - bucket
  - convert
  - eval
  - fields
  - fillnull
  - kmeans
  - outlier
  - rename
  - replace
- Transform and report
  - associate
  - chart
  - cluster
  - contingency
  - collect
  - correlate
  - diff
  - eventstats
  - format
  - highlight
  - makemv
  - mvcombine
  - mvexpand
  - nomv
  - overlap
  - rare
  - stats
  - strcat
  - timechart
  - top
  - transaction
  - typelearner
  - xmlunescape
- Administrative commands
  - admin
  - audit
  - run
- Unsupported search commands
  - createrss
  - dispatch
  - folderize
  - gentimes
  - idxprobe
  - inputcsv
  - load
  - map
  - outputatom
  - outputcsv
  - outputraw
  - outputtext
  - outputxml
  - page
  - rawstats
  - save
  - sendemail
  - tagcreate
  - tagdelete
  - tags
  - tagset
  - translate
- Deprecated search commands
  - nopartial
  - remote
  - searchps
  - select
  - streamedcsv
  - summary
  - timeline
  - uniq

This page last updated: 09/19/08 12:09pm

What's in this guide?

This manual teaches end users about Splunk and how to use Splunk search. This manual focuses primarily on accomplishing tasks through the web interface, Splunk Web, and the command line interface.

To help you start using Splunk, run through the Tutorial. The chapters following the tutorial focus on tasks, such as adding inputs, searching, setting alerts, and building reports. The manual ends with reference pages for search syntax, commands, and modifiers.

Refer to the search cheatsheet to help you construct useful searches right away.

Take note:

Before using Splunk, review the Installation manual for system requirements and step-by-step installation guides.
System administrators should refer to the Administration and Deployment manuals for advanced configuration and data management topics.
Those interested in customizing Splunk and creating applications for Splunk should refer to the Developer manual.
You can also share custom Splunk applications with other members of the Splunk community via SplunkBase.

Start | Next: About Splunk

Comments

he
Posted by shujujg on Dec 01 2008, 1:20am
aa
Posted by stone on Oct 22 2008, 3:17am
or if you're looking to index data from mysql, you should see the page on scripted inputs:

http://www.splunk.com/doc/3.3/admin/Scripted%20Inputs
Posted by emma on Jul 23 2008, 2:59pm
Hi elombera. You're going to want to check out this page in the Admin Manual:

http://www.splunk.com/doc/latest/admin/RouteDataToNonSplunkSystems
Posted by emma on Jul 23 2008, 2:40pm
Which manual is gonna help me point splunk at a MySQL DB?
Posted by elombera on Jul 23 2008, 2:06pm
I've been searching for a PDF manual that I can download and print. Is there one?
Posted by adamhmitchell on Jul 16 2008, 1:00pm
no comments yet.
Posted by jar2711 on Jun 24 2008, 8:55am

Log in to comment.